W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2014

Re: Fwd: New Version Notification for draft-nottingham-http-proxy-problem-01.txt

From: Eric Rescorla <ekr@rtfm.com>
Date: Tue, 15 Jul 2014 09:41:14 -0700
Message-ID: <CABcZeBPo9NScd4bLfxJEyMWvQYn6Si0jfbsh-g3-fhcmoMW4GA@mail.gmail.com>
To: Poul-Henning Kamp <phk@phk.freebsd.dk>
Cc: Mark Nottingham <mnot@mnot.net>, HTTP Working Group <ietf-http-wg@w3.org>
On Tue, Jul 15, 2014 at 8:52 AM, Poul-Henning Kamp <phk@phk.freebsd.dk>

> In message <CABcZeBOf62xCfnrtoqXMzGTW=
> WLtXwbi0YgTPaFZ4kp+0-t8tg@mail.gmail.com>, Eric Rescorla wr
> ites:
> >It is quite common to have sensitive information in the path part of
> >URLs (for instance, Amazon item numbers appear here), and in
> >many cases, this is the only sensitive information required to
> >reconstruct the user's browsing history. I don't consider this to
> >be "very little actual privacy" loss.
> And nothing prevents these apps from demanding full privacy (ie: TLS).
> But with a view to the future, all they need to do is shift the
> sensitive part of the data to the :query side, and they'll fine.

This seems like a forward-looking statement. I'm addressing it's current
truth value, and as I said, I believe that's not currently accurate.


> --
> Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
> phk@FreeBSD.ORG         | TCP/IP since RFC 956
> FreeBSD committer       | BSD since 4.3-tahoe
> Never attribute to malice what can adequately be explained by incompetence.
Received on Tuesday, 15 July 2014 16:42:21 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 30 March 2016 09:57:09 UTC