Browsing Firefox's hidden browsing history with Pin Patrol

If you’re wondering what someone’s been doing in Firefox then you could check the browser history, but if they’ve deleted it, along with any cookies, cache or logins, you won’t learn very much.

What isn’t so obvious is that Firefox has a hidden browsing history which records some of the sites you’ve visited, and isn’t removed when you wipe the official "Browsing & Download History".

This is all about HSTS (HTTP Strict Transport Security) and HPKP (HTTP Public Key Pinning), web security mechanisms which enable servers to protect against attacks using cookie hijacking, protocol downgrades and fraudulent certificates, among others.

These technologies are set up on the server and regular web users don’t ever have to know they exist, but Firefox does record some details on any compliant sites you’ve visited.

Pin Patrol is a free Firefox extension which displays the contents of this HSTS and HPKP log with a click. You’ll see the protected domains, the "score" (the number of days the domain has been visited), the date last visited, the expiration date and more. The table can be sorted by any field by clicking its column header, for example to quickly view the most visited sites, or see the sites in date order.

This won’t necessarily tell you very much. It won’t record every site, or even most sites, just those protected by HSTS and HPKP; it won’t display visited pages, just domains; entries may "expire" and disappear from the list quite quickly, so this is much better at telling you what happened this morning, than 6 months ago.

The details aren’t recorded for private browsing sessions, either, and they’ll be wiped if someone specified "Site Preferences" in the "Clear All History" box.

Despite that, Pin Patrol could give you information that’s not available in any other way, and it’s also handy for developers or security experts with an interest in HSTS and HPKP.

Pin Patrol is a free extension for Firefox.