Hacker News Reader

Not for me. Mac OS X 10.10.1, Chrome 39.0.2171.95. I get the same code even in incognito mode.

Same here, got same code on OSX 10.9.5 Chrome 39.0.2171.95

Well that's interesting. This may shed light on some of the seemingly conflicting results. On Mac OS X 10.10.1, Chrome 41.0.2264.2 (Canary):

Steps:

1. Open browser, open [1] in new tab. Get code X.

2. Open [1] in new incognito window. Get code Y.

3. Reload that incognito window. Get code Y.

4. Close incognito window.

5. Open [1] in second new incognito window. Get code X.

Subsequent iterations of opening/closing regular and incognito windows and/or restarting Chrome all yielded code X.

[1] http://www.radicalresearch.co.uk/lab/hstssupercookies/

Perhaps you started (2) before (1) finished?

Chrome has different SSL validation on each operating system - on Linux it uses it's own NSS instance, on OS X and Windows it uses the OS level certificate validation routines. Not sure how HSTS plays into that.

Not on my Chromebook Pixel.

Confirmed for me on Mac OS X 10.9.5, Chrome 39.0.2171.95

Not for me running Chrome 39.0.2171.95 on Fedora 21.

Same code for Chrome 39.0.2171.95 on Windows...