Re: [Add] meeting hum: should the IETF take up this work?

[Paul Ebersman <[e-mail]>]

aroach> policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ 
 
JLivingood> This speaks to the DNS query/response. But with DoH, this is
JLivingood> contained inside of an HTTP envelope, so to speak, which has
JLivingood> much more rich tracking - noted at
JLivingood> https://www.cloudflare.com/privacypolicy/ under website
JLivingood> visitors (which I presume applies to all HTTP
JLivingood> transactions). So the confluence of DNS and HTTP here seems
JLivingood> interesting to better understand and document as TRR-style
JLivingood> policies evolve. Since there is an HTTP server involved in
JLivingood> DoH, presumably all the normal HTTP log items are seen &
JLivingood> processed and can be logged, like user agent, cookies, and
JLivingood> so on.

Indeed. While things like java going away and more users trying to use
privacy badger and other things to make browser fingerprinting less
accurate, it's still scarily accurate. Being able to tie DNS queries and
individual browsers is yet another step down that slippery slope to
privacy loss.

  <https://www.eff.org/deeplinks/2018/06/gdpr-and-browser-fingerprinting-how-it-changes-game-sneakiest-web-trackers>