Subject: HSTS Fingerprinting.

From: Mike West <[email-masked]>
Date: Wed, 18 Sep 2019 10:10:18 +0900

A year or two ago, +John Wilander <[email-masked]> and others at Apple
proposed some changes to HSTS in
https://webkit.org/blog/8146/protecting-against-hsts-abuse/ that went some
way towards mitigating the abuses documented in Section 14.9 of RFC6797
<https://tools.ietf.org/html/rfc6797#section-14.9>. Given some shifts in
the way we're thinking about some other concepts, I've written up a short
proposal at https://github.com/mikewest/strict-navigation-security that
builds upon and simplifies Apple's proposal. We discussed it briefly at
yesterday's webappsec meeting
<https://github.com/w3c/webappsec/blob/master/meetings/2019/2019-09-TPAC-minutes.md#hsts-fingerprinting>,
and there seems to be interest in doing something in this space.

+Mark Nottingham <[email-masked]> and +Jeff Hodges
<[email-masked]> suggested
that I loop this group into that conversation, as the original websec group
has disbanded. Is it a topic this group would like to pick up? If not,
would y'all be comfortable with us defining some web browser behavior/Fetch
integration in webappsec that constrains the existing RFC?

Thanks!

-mike