Cookies and Pervasive Monitoring

[Mark Nottingham <[e-mail]>]

As part of revising the Cookie spec <https://tools.ietf.org/html/rfc6265>, we need to consider the Pervasive Monitoring impact, as per <https://tools.ietf.org/html/rfc7258>:

"""
Those developing IETF specifications need to be able to describe how they have considered PM, and, if the attack is relevant to the work to be published, be able to justify related design decisions.  This does not mean a new "pervasive monitoring considerations" section is needed in IETF documentation.  It means that, if asked, there needs to be a good answer to the question "Is pervasive monitoring relevant to this work and if so, how has it been considered?"
"""

At this point, I'd like people to start thinking about this, because it's pretty clear that long-lived cookies do have the potential for PM impact, particularly on unencrypted connections.

As with other changes to this spec, we'd want what we decide to be actually implemented, so if we see proposals in this space, they'll need to be backed by some expressions of intent to implement before we adopt them.

Regards,


--
Mark Nottingham   https://www.mnot.net/