Re: #645: Privacy impact of connection coalescing

On 21 November 2014 15:50, Mark Nottingham <mnot@mnot.net> wrote:

> The point is that these capabilities are new to this version of the
> protocol.


My point is that they are not really new.     HTTP/1.1 can be used to
measure latency (302 will do it, or looking at TLS handshake round trips,
connection:close also can give such info). HTTP/1.1 had persistent
connections that can be used to associated between 12% to 100% of a clients
requests depending on how many connections they use.

Furthermore, I think that such lists are only useful if they are complete
enumerations.   The harm of calling them out explicitly is that it may give
users/implementers the false impression that these are the only privacy
concerns they need to worry about.

regards


-- 
Greg Wilkins <gregw@intalio.com>  @  Webtide - *an Intalio subsidiary*
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.