Re: #645: Privacy impact of connection coalescing

On 20 November 2014 17:28, Mark Nottingham <mnot@mnot.net> wrote:
> <https://github.com/http2/http2-spec/pull/647>
>
> Any thoughts?

I like the correlation text, that's a real issue.  It's as much under
control of the client as many of the visible tracking capabilities
(cookies, JS, etc..), but highlighting what that means is worthwhile.

I'm lukewarm on the value of the SETTINGS/PING thing.  TCP window
scaling relies on knowing RTT, so another way of measuring it in a
less accurate way is of little intrinsic value.  It's certainly
harmless text inasmuch as it is correct, but it is only new if you
consider the layer in isolation and don't assume anything like (say)
lock-step request-response-request.  See
https://tools.ietf.org/html/rfc7323#section-3 for lower layers, and
JavaScript in general for higher.

I guess if you consider this as another hole to plug for the TOR
folks, then yes, but they have very special needs (and the skills to
match, no doubt).

Received on Friday, 21 November 2014 07:19:51 UTC