The TorBrowser will honor HSTS settings during a session, meaning that if you visit an HTTPS site and the HSTS flag is set, the browser will not allow an HTTP downgrade. Does this survive across restarts?
According to this test site, HSTS information does not survive a reboot on TBB 4.5 nor TBB 5 Alpha supported. This is probably because HSTS can be used to track browsers. It sounds as if the preload list will be supported and should protect users of major websites that enable HSTS.
-
1Note the preload list has certain caveats, so not all HSTS sites will be included. – Andrew Lott Jul 17 '15 at 14:14
-
@AndrewLott Have any useful links? I would love to link to the policy if it is laid out somewhere.... – Indolering Jul 26 '15 at 22:57
-
