Re: Fwd: New Version Notification for draft-nottingham-http-proxy-problem-01.txt

On 2014-07-15 17:52, Poul-Henning Kamp wrote:
> In message <>, Eric Rescorla wr
> ites:
>> It is quite common to have sensitive information in the path part of
>> URLs (for instance, Amazon item numbers appear here), and in
>> many cases, this is the only sensitive information required to
>> reconstruct the user's browsing history. I don't consider this to
>> be "very little actual privacy" loss.
> And nothing prevents these apps from demanding full privacy (ie: TLS).
> But with a view to the future, all they need to do is shift the
> sensitive part of the data to the :query side, and they'll fine.

Making this depend on path vs query is artificial and doesn't reflect 
how people use URIs.

If the sole purpose of splitting out :query is to make a privacy 
distinction then we should think about doing this in a way that's 
agnostic on how queries are used or not.

Best regards, Julian

Received on Tuesday, 15 July 2014 16:38:59 UTC