- From: Julian Reschke <julian.reschke@gmx.de>
- Date: Tue, 15 Jul 2014 18:38:27 +0200
- To: Poul-Henning Kamp <phk@phk.freebsd.dk>, Eric Rescorla <ekr@rtfm.com>
- CC: Mark Nottingham <mnot@mnot.net>, HTTP Working Group <ietf-http-wg@w3.org>
On 2014-07-15 17:52, Poul-Henning Kamp wrote: > In message <CABcZeBOf62xCfnrtoqXMzGTW=WLtXwbi0YgTPaFZ4kp+0-t8tg@mail.gmail.com>, Eric Rescorla wr > ites: > >> It is quite common to have sensitive information in the path part of >> URLs (for instance, Amazon item numbers appear here), and in >> many cases, this is the only sensitive information required to >> reconstruct the user's browsing history. I don't consider this to >> be "very little actual privacy" loss. > > And nothing prevents these apps from demanding full privacy (ie: TLS). > > But with a view to the future, all they need to do is shift the > sensitive part of the data to the :query side, and they'll fine. Making this depend on path vs query is artificial and doesn't reflect how people use URIs. If the sole purpose of splitting out :query is to make a privacy distinction then we should think about doing this in a way that's agnostic on how queries are used or not. Best regards, Julian
Received on Tuesday, 15 July 2014 16:38:59 UTC