W3C home > Mailing lists > Public > ietf-http-wg-old@w3.org > May to August 1996

Re: draft-ietf-http-state-mgmt-03.txt

From: Dave Kristol <dmk@allegra.att.com>
Date: Thu, 1 Aug 96 10:01:54 EDT
Message-Id: <9608011401.AA22196@zp>
To: sommerfeld%apollo.hp.com@hplb.hpl.hp.com
Cc: http-wg%cuckoo.hpl.hp.com@hplb.hpl.hp.com, snowhare@netimages.com
Bill Sommerfeld <sommerfeld@apollo.hp.com> writes:

  > The "security considerations" section of the draft does not include
  > any text regarding privacy concerns.

That's hardly true.  Section 7 is entitled PRIVACY; its first subsection,
7.1 is entitled "User Agent Control".

  > 
  > Here's some suggested text:
  > 
  > PRIVACY CONCERNS:
  > 
  > The protocol described in this draft can be used to keep track of the
  > browsing habits of a user without the user's knowledge or permission.
  > Many people consider this to be an unethical invasion of privacy.
  > 
  > Any HTTP client implementing this protocol MUST provide at least three
  > options for the user:
  > 	1) disable cookies entirely.
  > 	2) ask the user before setting a cookie.
  > 	3) set cookies without asking the user.

These are enumerated, in slightly different terms, in 7.1.
  > 
  > The default "out of the box" behavior of the client MUST NOT be #3.
  > 
  > Any HTTP client should provide a way for the user to know which
  > cookies are associated with a given page.

The thrust of the privacy considerations throughout the document is
to give the user control.  But I have to agree with Benjamin Franz
(<snowhare@netimages.com>) that user agent behavior is outside the
IETF's purview.  IETF can specify protocols, and they/we do that to
ensure interoperation.  I believe user agent behavior can be suggested
(we do), and then we have to rely on public (and, dare I say it,
marketplace) pressure to shine a spotlight on implementations that
pose a risk to users' privacy.

Dave Kristol
Received on Thursday, 1 August 1996 07:06:34 EDT

This archive was generated by hypermail pre-2.1.9 : Wednesday, 24 September 2003 06:32:05 EDT