Re: MITM and proxy messages [was: Call for Adoption: draft-song-dns-wireformat-http] from nicolas.mailhot@laposte.net on 2016-08-08 (ietf-http-wg@w3.org from July to September 2016)

From: <nicolas.mailhot@laposte.net>
Date: Mon, 8 Aug 2016 08:35:54 +0200 (CEST)
To: Adrien de Croy <adrien@qbik.com>
Cc: Martin Thomson <martin.thomson@gmail.com>, Amos Jeffries <squid3@treenet.co.nz>, ietf-http-wg@w3.org
Message-ID: <1764371480.288895.1470638154235.JavaMail.zimbra@laposte.net>

----- Mail original -----
De: "Adrien de Croy" 

Hi,

> Can use the DNS lookup facility to effectively log any URL that is 
> presented to the function, thereby leaking querystrings and URLs for 
> https URIs.

And that's a direct result of forcing proxy communication to piggy-back instead af specifying dedicated gateway frames in HTTP/2

When you piggy back you leak unrelated trafic. That's how piggy backing works.

Regards,

-- 
Nicolas Mailhot

Received on Monday, 8 August 2016 06:50:59 UTC