Re: Fingerprinting users with cached intermediate certificates

On Friday, February 24, 2017 at 5:44:12 PM UTC-6, Martin Thomson wrote:
> On Sat, Feb 25, 2017 at 6:45 AM, Daniel Veditz <[email protected]> wrote:
> > The difference isn't that Firefox caches intermediates, it's that it doesn't
> > fetch non-cached ones.
> 
> As the bug that Gerv cited shows, the act of fetching also leaks the
> same information.  

I'm confused - I don't believe that's the case. To Dan's point: the test isn't destructive - because we don't fetch missing. Running the test a second time doesn't show you that you're caching all of them. So while it's not perfectly reliable (since you can always start caching something new) the act of observing does not affect the observation.

> But there are plans to segment the intermediates
> cache to avoid cross domain tracking, which should help.  Tor disables
> the intermediates cache so doesn't suffer the fingerprinting risk
> (only the risk that the site can't be reached).

Tor keeps it memory-only and clears it on New Identity but doesn't disable it at this time: https://trac.torproject.org/projects/tor/ticket/21559