I have posted in greater detail about this on a blog post at https://browserprivacy.wordpress.com/2013/10/26/does-safari-on-os-x-mavericks-ignore-browsing-history-preferences/

but this excerpt is the gist of my question:

To verify that Safari has actually deleted my cookies as the GUI suggests, I sometimes check my ~/Library/Cookies folder where Safari and other applications store cookies in files with names like com.apple.appstore.cookies, Cookies.binarycookies, and a file I had never seen before called HSTS.plist. 

A quick Google search revealed very little pertaining to this particular HSTS.plist file, but HSTS may stand for HTTP Strict Transport Security, a web standard that allows web servers to mandate browsers interact with it using only HTTPS connections. I was surprised to see my previous (as in pre-Mavericks) browsing history comprised of over 100 sites I had visited within the past few months listed in this ~/Library/Cookies/HSTS.plist file.



HSTS.plist Structure

Opening my ~/Library/Cookies/HSTS.plist file in TextWrangler revealed the following structure:

<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”&gt;
<plist version=”1.0″>
<dict>
<key>com.apple.CFNetwork.defaultStorageSession</key>
<dict>
<key>HSTS Content Version</key>
<integer>1</integer>
<key>HSTS Store Schema Version</key>
<integer>2</integer>
<key>accounts.google.com</key>
<real>-infinity</real>

 <… and so on, with “real” values of either infinity or -infinity ..>

</dict>
<key>hstsd Disk Storage Schema Version</key>
<integer>1</integer>
</dict>
</plist>

Perhaps oddly, I also found no search results when I searched Google for “hstsd Disk Storage Schema Version”.

This ~/Library/Cookies/HSTS.plist file contained browsing history that I apparently had no way of permanently deleting, and which could potentially be used as a fingerprint for tracking (if accessible via WebKit) by Apple or others. Another thing that amazed me was that this file persisted in the sense that the HSTS.plist file and its original contents were replaced within a few minutes—perhaps via iCloud syncing…even though this machine did not have iCloud or any “Internet Accounts” enabled—even after multiple iterations of disabling all plug-ins, “Reset Safari..”, toggling “Private Browsing” on and off, and restarting the machine plus all of the following:

  • Closing Safari and other applications, deleting the HSTS.plist file, restarting
  • Closing Safari and other applications, deleting the re-spawned HSTS.plist file, saving a blank text file to ~/Library/Cookies/HSTS.plist, making its permissions read-only and myself owner, and then restarting
  • Logging in with another user’s account (with Administrator rights), deleting the HSTS.plist file, and restarting
  • Logging in with another user’s account (with Administrator rights), deleting the HSTS.plist file, saving a blank file with the same filename in that file’s location, setting its permission to read-only with another user as the owner, and then restarting

Using fseventer, I was able to see that this HSTS.plist file (and the browsing history it contained) re-spawning behavior occurred whenever I opened Safari and toggled Private Browsing mode. At least on this machine, HSTS.plist never re-spawns itself unless I’m connected to the internet.

This leaves me puzzled, so I would appreciate any reactions or responses you may have in the comments. Could this be: - malware? This seems less likely, since a scan of the hard drive in safe mode with clamXav turned up clean. - an artifact of a previous non-standard configuration? Perhaps this behavior is somehow related to something like Safari Mobile Bookmarks Sync (which I had disabled), or some sort of upgrade hiccup associated with upgrading a fully-patched copy of OS X Mountain Lion 10.8.5 to OS X Mavericks 10.9 a few days prior? - a potential new cookie-like vector that Apple and/or advertisers could potentially use to fingerprint users via a snapshot of their HTTPS browsing history, even when using Safari’s Private Browsing mode? This would be an outrage. - a new “feature” associated with Safari’s implementation of HSTS? Given the potential privacy implications, this would also be an outrage.

Aside from completely wiping the machine and reinstalling everything from scratch, I’m not sure what to do to get this artifact of old browsing history off of my machine. Even if this ~/Library/Cookies/HSTS.plist is just a simple cache of HSTS-enabled websites visited, it’s highly undesirable because it leaks browsing history–even in Private Browsing mode, and even across the GUI-accessible history and cache-clearing functions–and appears to be a highly persistent potential vector for fingerprinting users.

Isn't it just a list of sites known to request https only ?. mine is - domains are there that I've never visited, and the list is similar to the "// Force HTTPS for sites that have requested it" section of http://pastebin.com/WQijpvR4

  • Thank you for the comment. In my case, the domains in the ~/Library/Cookies/HSTS.plist file are sites known to request https only, but all are sites that I have visited in the past. And in general, sites requesting HTTPS only might be more likely to obtain/keep personally identifying information about users. In any case, what appears to be OSX Mavericks' implementation of HSTS leaves a lot to be desired. – Browser Privacy Nov 5 '13 at 20:36
  • In case it was unclear in my original posting (please see the blog for a fuller explanation), my concerns with this behavior from Mavericks were that: 1. Even after going to relatively elaborate lengths to keep my browsing history private, users appear to be unable to remove any of the browsing history contained in the HSTS.plist file. So if I were to visit sensitive sites--even in private browsing mode--there appears to be no way to erase capture of that browsing history, which seems to run afoul of both the letter and spirit of the relevant Safari preferences as I understood them. – Browser Privacy Nov 5 '13 at 20:38
  • ..and 2. That for many users, the HTTPS browsing history in this file may be sensitive and identifying. I haven't followed up in tracking this down, but it may even be the case that through a "bug" in certain users' Safari syncing preferences, etc. that Apple itself retains this information on its servers and that the re-spawning behavior I've noticed with the ~/Library/Cookies/HSTS.plist is the file or its contents being downloaded from Apple. For many users, this is undesired and a potentially significant privacy concern. But to be clear, I haven't determined whether that's the case yet. – Browser Privacy Nov 5 '13 at 20:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.