Re: Some half-baked thoughts about cookies.

Hi Poul-Henning,

On Tue, Aug 14, 2018 at 12:07:21PM +0000, Poul-Henning Kamp wrote:
> PS:  64 bits is not enough for everybody, in particularly not when
> they are randomly generated by less than perfect implementations.
> Make then 128 bit from the start.

No, that's what we discussed at the HTTP workshop 3 years ago already,
putting too many bits will cause the inverse of what is desired, it
adds unique client identifiers making tracking even easier and at the
same time will make distributed server stickiness very hard if not
impossible. If instead we only place a few bits for routing information
(say 16 bits) and place it upfront, all the routing information is
present and there is no need to distinguish between multiple clients.
The server will then be able to figure the real client from the
decrypted traffic (potentially via another client-fed ID if needed).

Regards,
Willy

Received on Tuesday, 14 August 2018 12:18:38 UTC