X-Git-Url: https://gitweb.stoutner.com/?a=blobdiff_plain;f=app%2Fsrc%2Fmain%2Fres%2Fxml%2Fnetwork_security_config.xml;h=e499e37fb0b80292e6fe20312a9d3dff796ff247;hb=5917df154b320eadd4c2d935baf30f98fd6055c4;hp=e7ed677fd2823c699e6e99b406fdacb880c51a3e;hpb=06f516f2f5c745981e292451d01b9df7d1fd57eb;p=PrivacyBrowserAndroid.git

diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index e7ed677f..e499e37f 100644
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 
 <!--
-  Copyright © 2018 Soren Stoutner <soren@stoutner.com>.
+  Copyright © 2018,2020 Soren Stoutner <soren@stoutner.com>.
 
   This file is part of Privacy Browser <https://www.stoutner.com/privacy-browser>.
 
@@ -18,7 +18,8 @@
   You should have received a copy of the GNU General Public License
   along with Privacy Browser.  If not, see <http://www.gnu.org/licenses/>. -->
 
-<!-- Allow HTTP traffic. -->
-<network-security-config>
-    <base-config cleartextTrafficPermitted="true" />
+<!-- Allow HTTP traffic and disable HSTS, which has no benefit for Privacy Browser (because unspecified links default to HTTPS) but has negative fingerprinting implications. -->
+<network-security-config
+    xmlns:tools="http://schemas.android.com/tools">
+    <base-config cleartextTrafficPermitted="true" hstsEnforced="false" tools:ignore="InsecureBaseConfiguration" />
 </network-security-config>
\ No newline at end of file