W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2014

Re: Fwd: New Version Notification for draft-nottingham-http-proxy-problem-01.txt

From: Julian Reschke <julian.reschke@gmx.de>
Date: Tue, 15 Jul 2014 18:38:27 +0200
Message-ID: <53C55903.3040906@gmx.de>
To: Poul-Henning Kamp <phk@phk.freebsd.dk>, Eric Rescorla <ekr@rtfm.com>
CC: Mark Nottingham <mnot@mnot.net>, HTTP Working Group <ietf-http-wg@w3.org>
On 2014-07-15 17:52, Poul-Henning Kamp wrote:
> In message <CABcZeBOf62xCfnrtoqXMzGTW=WLtXwbi0YgTPaFZ4kp+0-t8tg@mail.gmail.com>, Eric Rescorla wr
> ites:
>
>> It is quite common to have sensitive information in the path part of
>> URLs (for instance, Amazon item numbers appear here), and in
>> many cases, this is the only sensitive information required to
>> reconstruct the user's browsing history. I don't consider this to
>> be "very little actual privacy" loss.
>
> And nothing prevents these apps from demanding full privacy (ie: TLS).
>
> But with a view to the future, all they need to do is shift the
> sensitive part of the data to the :query side, and they'll fine.

Making this depend on path vs query is artificial and doesn't reflect 
how people use URIs.

If the sole purpose of splitting out :query is to make a privacy 
distinction then we should think about doing this in a way that's 
agnostic on how queries are used or not.

Best regards, Julian
Received on Tuesday, 15 July 2014 16:38:59 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 30 March 2016 09:57:09 UTC