Re: Fingerprinting users with cached intermediate certificates

Martin Thomson <[email protected]> Sat, 25 Feb 2017 10:44:03 +1100

Newsgroups	gmane.comp.mozilla.security
Message-ID	<CAPLxc=WgxEnsa115JjEajop2NpgDYYHvB_aR0rB5psbTiquwAw@mail.gmail.com>

On Sat, Feb 25, 2017 at 6:45 AM, Daniel Veditz <[email protected]> wrote:
> The difference isn't that Firefox caches intermediates, it's that it doesn't
> fetch non-cached ones.

As the bug that Gerv cited shows, the act of fetching also leaks the
same information.  But there are plans to segment the intermediates
cache to avoid cross domain tracking, which should help.  Tor disables
the intermediates cache so doesn't suffer the fingerprinting risk
(only the risk that the site can't be reached).