Re: [http-state] Ticket 3: Public Suffixes

[Adam Barth <[e-mail]>]

On Sat, Jan 16, 2010 at 3:39 AM, Yngve N. Pettersen (Developer Opera
Software ASA) <[e-mail]> wrote:
> Alternative 4: Use a DNS based heuristic by only allowing cookies set to
> domains that have an IP address defined. If there is no IP address, remove
> the domain attribute

One problem with this approach is that a number of major ISPs,
including COMCAST, return IP addresses for all non-existent domains.
The ISPs use these non-existent domains to show advertisements and
increase revenue.  Personally, I'd rather that they abstain from this
practice, but it demonstrates that this heuristic is somewhat fragile
for the security property we need.

> Alternative 5: (which require an extensive change of the cookie
> specification)

As Daniel Stenberg says, extensive changes to the spec are off the
table in phase one.  However, we should revisit this approach in phase
two.

Adam