bugGNU Wget - Bugs: bug #51666, Please hash the hostname in...


bug #51666: Please hash the hostname in ~/.wget-hsts files

Submitted by:  Noël Köthe <nok>
Submitted on:  Sat 05 Aug 2017 02:14:03 PM UTC  
Category: Feature RequestSeverity: 3 - Normal
Priority: 5 - NormalStatus: None
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Open
Release: trunkOperating System: GNU/Linux
Reproducibility: Every TimeFixed Release: None
Planned Release: NoneRegression: No
Work Required: NonePatch Included: No

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Fri 18 Aug 2017 06:53:12 PM UTC, comment #3:

> We can do both, hash and still keep the readable to the user only

... hash and still keep the files readable ...

Ander Juaristi <ajuaristi>
Fri 18 Aug 2017 06:51:12 PM UTC, comment #2:

I'm not generally against these kind of small tweaks that don't harm and slightly improve user's privacy.

If Firefox doesn't do it, we don't care: it's their business and they will end up doing it if users request that feature (maybe because they saw it in wget).

Private SSH keys can be protected with a password if you want to.

> While we could hash anything, it would be way safer for you to protect your complete home directory

We can do both, hash and still keep the readable to the user only. If the overhead is not much I would go for it. That is the basis of every security framework out there: if the benefits of having 2 security mechanisms instead of only 1 outweigh the drawbacks, then implement 2 instead of 1.

Ander Juaristi <ajuaristi>
Sat 05 Aug 2017 03:07:46 PM UTC, comment #1:

The files are read/write only to the user (in case you didn't protect your home directory appropriately).

If you are still concerned, what about ~/.mozilla/firefox/*.default/SiteSecurityServiceState.txt and likely hundreds or thousands of other files containing potential private information ?

Not thinking of your private keys lying around in .ssh/.

And even file dates and sizes are potential private data leaks.

While we could hash anything, it would be way safer for you to protect your complete home directory.

We could think about an option, just in case you want to keep your HSTS cache in a public space, e.g. /var. But we already think of using SQLite for storing and maybe sharing with Firefox.

Tim Ruehsen <rockdaboot>
Project Administrator
Sat 05 Aug 2017 02:14:03 PM UTC, original submission:


a feature request from a Debian user:


I recently discovered the .wget-hsts file in my home directory which is used to persist state for HSTS:


It contains lines such as:

# HSTS 1.0 Known Hosts database for GNU Wget.
# Edit at your own risk.
# <hostname> <port> <incl. subdomains> <created> <max-age>
github.com 0 1 1450887745 31536000
ftp-master.debian.org 0 0 1472482586 15552000
diffoscope.org 0 0 1449765396 15768000
reproducible-builds.org 0 0 1471542629 15552000
http://www.dropbox.com 0 1 1458394011 15552000
reproducible.debian.net 0 0 1448074844 15552000

I can't help but think of ~/.ssh/known_hosts which moved to hashing the hostname for various security/privacy concerns. Shouldn't wget make the parallel change?

Thank you.

Noël Köthe <nok>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by ajuaristi (Posted a comment)
  • -unavailable- added by nok
  • -unavailable- added by rockdaboot (Posted a comment)
  • -unavailable- added by nok (Submitted the item)
  • -unavailable- added by nok

    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 07 Aug 2017 06:56:23 PM UTCnokCarbon-Copy-=>Added -unavailable-
    Sat 05 Aug 2017 02:14:03 PM UTCnokCarbon-Copy-=>Added -unavailable-

    Back to the top

    Powered by Savane 3.1-cleanup1