RE: Frame Ancestors and Referrer (Re: [webappsec] Call for Consensus: Stop work on Content Security Policy 1.0, transition to WG Note)

On Oct 24, 2014 7:40 PM, "Sean Snider" <ssnider@yahoo-inc.com> wrote:
> I really cannot see a "valid" use-case for "none",

Strong disagree.

> But back to referrer. . . what's the valid use-case for "none"?  Is it
really just about data-leakage?  If that's
> the case, they I'd argue strongly against none, and just allow stripping
down.  Rarely do hostname and scheme
> contain sensitive information, and in that case. . .really the site
itself should be setup differently :P

The forums of any number of community groups are a treasure trove of off
site links. Support Groups (human support, not technical support) for
things like medical conditions (schizophrenia, HIV/AIDS), identity
confusion (people who have not come out yet, gender reassignment), home and
health issues (divorce, financial instability) - all the sorts of things
that community often do not want leaking out into their advertising
profile.  These sites are often separately hosted precisely because people
do not *want* to be using Facebook/Google profiles for these sorts of
things. One can't always hide in the origin.

-tom

Received on Saturday, 25 October 2014 01:25:28 UTC