Re: HTTP router point-of-view concerns

Nico Williams <nico@cryptonector.com> Fri, 19 July 2013 18:34 UTC

Resent-Date: Fri, 19 Jul 2013 18:33:32 +0000
Resent-Message-Id: <E1V0FUi-0007Dk-Rt@frink.w3.org>
MIME-Version: 1.0
In-Reply-To: <6760.1374257967@critter.freebsd.dk>
References: <CA+qvzFPUpcm6kUtJx+rTw8Dpp4Gtx4Bmr3XPDhjNsjchUfN9_w@mail.gmail.com> <51DE1E32.9010801@treenet.co.nz> <CAP+FsNdcYhA=V5Z+zbt70b5e7WmcmXgjG5M9L3vfXeXfTwmRnw@mail.gmail.com> <51DE327C.7010901@treenet.co.nz> <CABkgnnXeqD6wh0dcJ1Dz=4PLAJNkDeGcCuzMr9ATd_7xS7nbGQ@mail.gmail.com> <CABP7RbcUkLf3CTAB4jwicnsiKWLGVY6=hX0k=0256SR_gcVt9A@mail.gmail.com> <092D65A8-8CB7-419D-B6A4-77CAE40A0026@gmail.com> <3835.1373612286@critter.freebsd.dk> <CD9E163F-1225-4DA8-9982-8BDBD16B1051@mnot.net> <1772.1373629495@critter.freebsd.dk> <CAK3OfOiRTw9CMVw88eW1G95t0hx0ZfGitHw2Co4bV-fN2dnv7g@mail.gmail.com> <6633.1374254534@critter.freebsd.dk> <CAK3OfOjSjPXZhA5TvTn8nuJgu9V_wGE81LRz5axfFuifjymj7w@mail.gmail.com> <6760.1374257967@critter.freebsd.dk>
Date: Fri, 19 Jul 2013 13:32:59 -0500
Message-ID: <CAK3OfOgRWzvj+-XfDLw8zX_=Kd_qQWXXEuhp-_1fcLZfYqyo8Q@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Poul-Henning Kamp <phk@phk.freebsd.dk>
Cc: Mark Nottingham <mnot@mnot.net>, Sam Pullara <spullara@gmail.com>, James M Snell <jasnell@gmail.com>, Martin Thomson <martin.thomson@gmail.com>, Amos Jeffries <squid3@treenet.co.nz>, HTTP Working Group <ietf-http-wg@w3.org>
Content-Type: text/plain; charset="UTF-8"
Received-SPF: none client-ip=208.97.132.177; envelope-from=nico@cryptonector.com; helo=homiemail-a49.g.dreamhost.com
Subject: Re: HTTP router point-of-view concerns
Archived-At: <http://www.w3.org/mid/CAK3OfOgRWzvj+-XfDLw8zX_=Kd_qQWXXEuhp-_1fcLZfYqyo8Q@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

On Fri, Jul 19, 2013 at 1:19 PM, Poul-Henning Kamp <phk@phk.freebsd.dk> wrote:
> In message <CAK3OfOjSjPXZhA5TvTn8nuJgu9V_wGE81LRz5axfFuifjymj7w@mail.gmail.com>
> , Nico Williams writes:
>
>>I'm not sure how any session identifier would survive silly
>>anti-cookie regulations from the EU.  A session ID is still a cookie.
>
> Read the actual regulation ?

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:NOT

?

My point stands.  How is a *any* session identifier different from a
cookie?  The only differences might relate to how they might leak to
third parties.

>>I don't see how PRISM affects this either.  If anything, keeping
>>session state on the server... only helps PRISM: more data to chomp on.
>
> It means that any random computer I use to access a given service is
> not polluted with bit-droppings saying I did so.

How do you know when you're done using it that it's not still holding
on to your at-one-time open sessions?  Here there is a somewhat useful
answer: you could ask the service [from another device that you do
trust] to close those sessions.

Session logout is an important feature to have (though in all cases we
have to trust the server).

HTTP router point-of-view concerns Christian Parpart
Re: HTTP router point-of-view concerns Amos Jeffries
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns Amos Jeffries
Re: HTTP router point-of-view concerns Christian Parpart
Re: HTTP router point-of-view concerns Amos Jeffries
Re: HTTP router point-of-view concerns Michael Sweet
Re: HTTP router point-of-view concerns Martin Thomson
Re: HTTP router point-of-view concerns James M Snell
Re: HTTP router point-of-view concerns Sam Pullara
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns Amos Jeffries
Re: HTTP router point-of-view concerns Sam Pullara
Re: HTTP router point-of-view concerns Patrick McManus
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns James M Snell
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns James M Snell
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns Sam Pullara
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns Martin Thomson
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Mark Nottingham
Re: HTTP router point-of-view concerns Mike Belshe
Re: HTTP router point-of-view concerns Gábor Molnár
Re: HTTP router point-of-view concerns Gábor Molnár
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Michael Sweet
Re: HTTP router point-of-view concerns Christian Parpart
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Patrick McManus
Re: HTTP router point-of-view concerns Jeff Pinner
Re: HTTP router point-of-view concerns Martin Thomson
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns Ludin, Stephen
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns James M Snell
Re: HTTP router point-of-view concerns Amos Jeffries
Re: HTTP router point-of-view concerns Amos Jeffries
Re: HTTP router point-of-view concerns Roberto Peon
Re: HTTP router point-of-view concerns Yoav Nir
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Sam Pullara
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Mark Delany
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Yoav Nir
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Yoav Nir
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Stephen Farrell
Re: HTTP router point-of-view concerns Willy Tarreau
Re: HTTP router point-of-view concerns Sam Pullara
Re: HTTP router point-of-view concerns Nicolas Mailhot
Re: HTTP router point-of-view concerns Nicolas Mailhot
Re: HTTP router point-of-view concerns Nicolas Mailhot
Re: HTTP router point-of-view concerns Martin Nilsson
Re: HTTP router point-of-view concerns Nico Williams
Re: HTTP router point-of-view concerns Nico Williams
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Nico Williams
Re: HTTP router point-of-view concerns Poul-Henning Kamp
Re: HTTP router point-of-view concerns Nico Williams