I would like to point out that HSTS is not compatible with private browsing because by saving the information that the particular site must be accessed by HTTPS the browser exposes the fact that the said site was previously accessed. I hope we will eventually come to required secure HTTP by default with the next versions of the protocol.
Briefly: a page can embed a hidden image with a http:// URL (with a different hostname, used just for tracking purposes). If that image gets loaded over HTTPS, it means the site has been visited before. If it loads over HTTP, the site hasn't been visited before; it then redirects to the HTTPS version and sends a HSTS header so on the next visit it goes straight to HTTPS.
That stores one bit of information. Repeat 32 times (with 32 different host names) and you can store a unique 32-bit tracking number that persists even when cookies are cleared.
Comments
I would like to point out that HSTS is not compatible with private browsing because by saving the information that the particular site must be accessed by HTTPS the browser exposes the fact that the said site was previously accessed. I hope we will eventually come to required secure HTTP by default with the next versions of the protocol.
Is it not effectively like someone hand-typing the address with HTTPS? how does it expose anything?
Briefly: a page can embed a hidden image with a http:// URL (with a different hostname, used just for tracking purposes). If that image gets loaded over HTTPS, it means the site has been visited before. If it loads over HTTP, the site hasn't been visited before; it then redirects to the HTTPS version and sends a HSTS header so on the next visit it goes straight to HTTPS.
That stores one bit of information. Repeat 32 times (with 32 different host names) and you can store a unique 32-bit tracking number that persists even when cookies are cleared.