Re: [Acme] ACME breaking change: Most GETs become POSTs

[Jacob Hoffman-Andrews <[e-mail]>]

On 08/31/2018 01:51 PM, Adam Roach wrote:
> The baseline problem here is that the original analysis that determined 
> that orders, authorizations, challenges, and certificates were "not 
> sensitive" was incorrect. These are all potentially sensitive from a 
> privacy perspective. Perhaps not in isolation, but the problem here is 
> correlation, not isolation.

What do you think about the question of preventing correlation of the 
existence of URLs? Do you think that's in-scope, or should we only 
prevent correlation of the contents?

Here's another example of a URL scheme where revealing existence would 
reveal some correlation data:

/account/100/certificate/example.com
/account/201/certificate/example.net
/account/100/certificate/secret.example.com

Personally, I think it will be intractable to hide the 
existence/non-existence of URLs, and we should just mention it as a risk 
in the security considerations section. That leads me to the conclusion 
that it's fine to return Unauthorized for resources that exist, by the 
client does not own.