What is 'site connectivity data?'

[John connor]

I see this with my delete cookies and history delete button. It's an addon called Clear Recent History.

[New Tobin Paradigm]

Release Notes, Search, Go, Do, Stop not.

[John connor]

All it says is:

Added an option to clear Site Connectivity Data (delete history).

[JustOff]

This has already been answered.

[John connor]

Okay. I guess the answer is:

it's about HSTS/HPKP data stored in SiteSecurityServiceState.txt.

Then I won't be touching that.

[Pallid Planetoid]

I guess the question would be whether or not there is any advantage in any way to clear this specific history (that is to check the "Site Connectivity Data" option in "Settings for Clearing History when Pale Moon Closes")....

[John connor]

I guess the question would be whether or not there is any advantage in any way to clear this specific history (that is to check the "Site Connectivity Data" option in "Settings for Clearing History when Pale Moon Closes")....

The only thing I can think of is if a site that was using TLS and HSTS no longer does, you can clear the connectivity settings and regain access to the website, you and yourself quite frankly. Other than that, I really don't know what else it would be used for.

[coffeebreak]

Other than that, I really don't know what else it would be used for.

People who clear site connectivity data do so for reasons of privacy...

New Browser security features have tracking side-effects [ghacks]
How to prevent HSTS tracking in Firefox [ghacks]
Browsing in privacy mode? Super Cookies can track you anyway [arstechnica]
http://www.radicalresearch.co.uk/lab/hstssupercookies

[Pallid Planetoid]

^ Thanks for the info coffeebreak --- in as much as given the option of security or privacy superseding the other, I would personally trade security in place of privacy assuming both cannot be achieved equally and from this perspective it would be presumably recommended to not clear this specific "site connectivity data" history since it needs to be available to enhance security (via HSTS). Besides that, as I understand it, this text file will become repopulated with the "connectivity data" once the corresponding website is visited again anyway as long as presumably assuming that the "network.stricttransportsecurity.enabled" pref is not set to "false". Am I correct in my conclusion here ?

[John connor]

Very interesting. The first linked article there from ghacks mentions a website to visit to see all the websites you visited, but nothing shows up for me despite having network.stricttransportsecurity.enabled set to true. I wonder if this is because of my highly configured Sandboxie I use for Pale Moon? It must be. Where is this HSTS text file located? If it's in the profile folder, then that will be exactly why Sandboxie dumps it on browser exit.

Edit-

Okay, I visted my site which does have HSTS enabled and that website still doesn't show anything. I don't get this. Albeit, the website is constantly loading despite turning off uBlock for that site. I don't use NoScript anymore.

[satrow]

I don't have Sandboxie yet I get the same results = nothing.

[John connor]

Hmm, thanks for confirming. Just to make sure, you do have the HSTS setting set to True?

[satrow]

Yes. I checked before replying.

[Pallid Planetoid]

^ If we are talking about the SiteSecurityServiceState.txt file, I don't have this file on my system (for Pale Moon) other than the Mozilla\Firefox\Profiles location and I've tried network.stricttransportsecurity.enabled set to both "true" and "false", currently set to default "true".

[John connor]

Interesting. Great thing about everything.exe is that it will show all files and their locations. I have found Tor and Thunderbird having this file SiteSecurityServiceState.txt.

Question: So is this like browser fingerprinting? I wonder because I could maybe have an extension crafted that would use the HSTS setting to find Dup accounts to members who register more than once on my site. I asked about this, but for HTML5 cookies and I got shot down saying it was an EU violation and all this crap. I don't care about EU law anyway. They have no effect here. I live in the U.S. (thank God) and the server is in Chicago. Maybe they will deny me entry if I go to say, France? LOL My current tactic is IP addresses and cookies only, and a little detective work. I have two forums.

[Moonchild]

You can't reliably use HSTS data to determine anything. The mere fact that someone visits a site and may get this data stored (if the site uses HSTS) doesn't mean they have an account or what not, just that, at some point in time, they visited the site.

As for data actually getting stored in the file, that depends on whether you visit sites that use HSTS as much as having the setting enabled (and history settings as well, IIRC, to prevent this kind of visiting data from leaking out of e.g. private browsing windows and the likes).

The fact that a third party site (like that demo site) can't determine the other sites you've visited they they check for in Pale Moon is a good thing, no? Aren't you happy about that?

[John connor]

The mere fact that someone visits a site and may get this data stored (if the site uses HSTS) doesn't mean they have an account or what not, just that, at some point in time, they visited the site.

I see. Thanks.

The fact that a third party site (like that demo site) can't determine the other sites you've visited they they check for in Pale Moon is a good thing, no? Aren't you happy about that?

I guess so, but I was wondering why that was? How was it that site wasn't able to determine what sites I've visited? Did you add code to PM to prevent that? Because I have a whole list of sites in that HSTS file under my profile.

[SpockFan02]

That's funny, the demo site had nothing in the Sites you've probably visited category, and both wikimedia.org and duckduckgo.com were included under Sites you probably haven't visited. Whatever threw them off, I'm glad that it did!

[cartel]

the demo site is gone.
I thought PM frowned on this kind of behavior.
Is this something that can be stopped?

I set group policy rules: Additional Rules, New Path Rule.
And the file still gets created.

[Moonchild]

Not sure what you're going on about.

Does Pale Moon frown on the use of security measures like HSTS or HPKP? No.
Does Pale Moon frown on sites using these measures to collect privacy data? Yes.
Can you have your cake and eat it too? No.

The HSTS setting is a security-privacy tradeoff. Its setting is under your direct control. HPKP is not subject to the same leakage.
The file is created for both protocols. If you're concerned about local file privacy, then use a private browsing window.