- From: Shivan Kaul Sahib <shivankaulsahib@gmail.com>
- Date: Thu, 8 Jun 2023 12:14:23 -0700
- To: public-webappsec@w3.org, HTTP Working Group <ietf-http-wg@w3.org>
Received on Thursday, 8 June 2023 19:15:05 UTC
Hi folks, this is a head's up and early request for feedback: Brave is shipping support for an HTTP response header sent by a website that wants the client to treat the website as "off-the-record" i.e. not store anything in storage, not record the site visit in history etc. Kind of like incognito/private browsing mode but site-initiated and only for a specific website. The header is simple: it would look like `Request-OTR: 1`. Some details here: https://brave.com/privacy-updates/26-request-off-the-record/#request-otr-header. Currently we bootstrap for websites that have expressed interest in this (mainly websites that have help resources for domestic violence victims, which was the driving use-case) by preloading a list of websites into the browser, but it would be nice to standardize the header. We're considering doing the work in the HTTP WG at IETF: it's envisioned to be a simple header. I see that this idea was previously discussed in W3C WebAppSec: https://lists.w3.org/Archives/Public/public-webappsec/2015Sep/0016.html, and there was a draft Mozilla spec: https://wiki.mozilla.org/Security/Automatic_Private_Browsing_Upgrades, though as a CSP directive. Happy to hear what people think.
Received on Thursday, 8 June 2023 19:15:05 UTC