Re: [DNSOP] Public Suffix List

[Florian Weimer <[e-mail]>]

* Gervase Markham:

> Say adserver.co.uk has contracts with mybank.co.uk, mygrocer.co.uk,
> mypetstore.co.uk to supply them with ads. adserver.co.uk can set the
> ad-tracking cookie for .co.uk and build up a cross-site profile of a
> particular user, perhaps augmented by information passed to them by one
> or more of the sites concerned. This is a privacy issue.

I'd love to see an official statement from the Mozilla Foundation that
cross-domain ad correlation is evil, and should be stopped by
technology.  Certainly this is not what you're trying to say here.

I guess the real issue is that by setting a cookie for co.uk, it's
possible to exploit session fixation vulnerabilities in web sites under
co.uk.  Unfortunately, the Public Suffix List web site is a bit unclear
in this regard.  It does not list a single protocol spec which requires
this sort of data.
_______________________________________________
DNSOP mailing list
[e-mail]
https:From [e-mail]  Wed Jun 11 13:16:08 2008
Return-Path: <[e-mail]>
X-Original-To: [e-mail]
Delivered-To: [e-mail]
Received: from [127.0.0.1] (localhost [127.0.0.1])
	by core3.amsl.com (Postfix) with ESMTP id 5CE983A689A;
	Wed, 11 Jun 2008 13:16:08 -0700 (PDT)
X-Original-To: [e-mail]
Delivered-To: [e-mail]
Received: from localhost (localhost [127.0.0.1])
	by core3.amsl.com (Postfix) with ESMTP id 765243A689A
	for <[e-mail]>; Wed, 11 Jun 2008 13:16:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.183
X-Spam-Level: 
X-Spam-Status: No, score=-3.183 tagged_above=-999 required=5
	tests=[AWL=-0.934, BAYES_00=-2.599, HELO_EQ_DE=0.35]
Received: from mail.ietf.org ([64.170.98.32])
	by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id BlKBX0qYxNPc for <[e-mail]>;
	Wed, 11 Jun 2008 13:16:01 -0700 (PDT)
Received: from mail.enyo.de (mail.enyo.de [IPv6:2001:14b0:202:1::a7])
	by core3.amsl.com (Postfix) with ESMTP id 73B4D3A6878
	for <[e-mail]>; Wed, 11 Jun 2008 13:16:00 -0700 (PDT)
Received: from deneb.vpn.enyo.de ([212.9.189.177] helo=deneb.enyo.de)
	by mail.enyo.de with esmtp id 1K6Wjm-0004VX-Lt;
	Wed, 11 Jun 2008 22:16:06 +0200
Received: from fw by deneb.enyo.de with local (Exim 4.69)
	(envelope-from <[e-mail]>)
	id 1K6Wjj-0005zQ-Us; Wed, 11 Jun 2008 22:16:03 +0200
From: Florian Weimer <[e-mail]>
To: Gervase Markham <[e-mail]>
References: <[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]> <[e-mail]>
	<[e-mail]> <[e-mail]>
	<[e-mail]> <[e-mail]>
	<[e-mail]> <[e-mail]>
	<[e-mail]>
	<[e-mail]>
Date: Wed, 11 Jun 2008 22:16:03 +0200
In-Reply-To: <[e-mail]> (Gervase Markham's message of
	"Wed, 11 Jun 2008 13:45:28 +0100")
Message-ID: <[e-mail]>
MIME-Version: 1.0
Cc: [e-mail], Jamie Lokier <[e-mail]>,
	David Conrad <[e-mail]>,
	Jelte Jansen <[e-mail]>, [e-mail]
Subject: Re: [DNSOP] Public Suffix List
X-BeenThere: [e-mail]
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>,
	<mailto:[e-mail]?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/dnsop>
List-Post: <mailto:[e-mail]>
List-Help: <mailto:[e-mail]?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>,
	<mailto:[e-mail]?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: [e-mail]
Errors-To: [e-mail]

* Gervase Markham:

> Say adserver.co.uk has contracts with mybank.co.uk, mygrocer.co.uk,
> mypetstore.co.uk to supply them with ads. adserver.co.uk can set the
> ad-tracking cookie for .co.uk and build up a cross-site profile of a
> particular user, perhaps augmented by information passed to them by one
> or more of the sites concerned. This is a privacy issue.

I'd love to see an official statement from the Mozilla Foundation that
cross-domain ad correlation is evil, and should be stopped by
technology.  Certainly this is not what you're trying to say here.

I guess the real issue is that by setting a cookie for co.uk, it's
possible to exploit session fixation vulnerabilities in web sites under
co.uk.  Unfortunately, the Public Suffix List web site is a bit unclear
in this regard.  It does not list a single protocol spec which requires
this sort of data.
_______________________________________________
DNSOP mailing list
[e-mail]
http//www.ietf.org/mailman/listinfo/dnsop


s://www.ietf.org/mailman/listinfo/dnsop