![\"Intermediate](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/03\/CertificateChain.png\")
To prevent the web from being a mess of certificate errors, browsers came up with ways to deal with those misconfigurations. Firefox does this by building a local cache of Intermediates it receives from properly configured sites. It can then look to that cache for the proper certificate when making other connections.<\/p>\n
There are, however, a couple of downsides to Firefox compensating for missing Intermediates. For one, it creates the illusion that a misconfigured site is working properly. An inexperienced server admin may not realize that their site\u2019s HTTPS connection is only working properly because of his browser\u2019s cache.<\/p>\n
The other downside is that a researcher has found a way to fingerprint users based on the uniqueness of their specific cache.<\/p>\n
This fingerprinting technique works by loading resources from a variety of misconfigured websites which don\u2019t have properly configured certificate chains, each website using certificates from different CAs. If the resource can be successfully loaded, it means that your Firefox browser already had the needed Intermediate(s) in its cache. If it can\u2019t be loaded, Firefox didn\u2019t make the HTTPS connection because it did not have the Intermediate. Which Intermediates were and were not cached can then be recorded and saved, and if the data is unique enough, it can build a unique fingerprint.<\/p>\n
There are loads of CAs out there. You likely know the big ones like Symantec, Comodo, and GoDaddy. But do you know HARICA? Also known as the Hellenic Academic & Research Institutions Certificate Authority, which serves Greece\u2019s academic community? No?<\/p>\n
These niche CAs serve specific regions, government offices, and other specialized communities. They have root certificates residing in millions of computers across the globe, even though it’s unlikely most users will ever encounter one of their certificates.<\/p>\n
So while having the cached Intermediate for any of Symantec\u2019s roots may not do much to uniquely identify you, the Intermediates for HARICA of Hongkong\u2019s Postal service can.<\/p>\n
Alexander Klink, who created this technique, wrote<\/a> on his blog, \u201ccertain CAs have customers mostly in one country or region, or might have even more specific use-cases which lets you infer even more information \u2212 i.e. a user who has the \u00bbDeutsche Bundestag CA\u00ab cached [Ed: The Bundestag is one of Germany\u2019s legislative bodies, like the US House of Representatives] is most probably located in Germany and probably at least somewhat interested in politics.\u201d<\/p>\n Klink noted some of the different uses for the technique, including linking a user to a Private Browsing session (since they share the same cache) and detecting if the client device is a malware analysis sandbox, \u201cwhich would probably have none or very few of the common intermediates cached.\u201d<\/p>\n Unlike other browsers, Firefox does not perform AIA fetching<\/a>, which uses embedded information in the server\u2019s certificate to know where to get a copy of the Intermediates needed. Ironically, Firefox avoided implementing AIA fetching because it has its own privacy downsides, and instead opted to use a cache which made the browser vulnerable to this fingerprinting technique.<\/p>\n Google Chrome uses AIA fetching which renders it immune to this technique. Because Chrome can simply download the needed Intermediate during the connection, it isn\u2019t possible to build a list of what Intermediates it has previously encountered.<\/p>\n Klink built a proof of concept which allows you to see this new technique in action<\/a> (You will, of course, need to visit the page in Firefox). The test looks for 325 different Intermediate certificates.<\/p>\n Earlier this year, Firefox implemented a \u201cfont whitelist\u201d<\/a> to combat a fingerprinting technique which tried to identify you via your computer\u2019s supported fonts.<\/p>\n