Re: Alt-Svc Privacy Concerns

[Erik Nygren <[e-mail]>]

On Sat, Apr 9, 2016 at 1:41 PM, Phil Lello <[e-mail]> wrote:

> I'm concerned that Alt-Svc, especially used like this, is re-introducing
> the sort of privacy issues people have been trying to eliminate with
> cookies for years. Appologies if this has already been discussed and I
> missed it.
>

I don't see the issue here really being with Alt-Svc. Rather, this is
another issue/risk with consolidating requests for multiple origins onto a
single TLS connection that has a valid cert for all of the origins. (I
don't think this was on my list in the slides in B.A. in discussion of the
ORIGIN frame and related topics, but is certainly in that class I'd
issues.)

I'm not sure I see how Alt-Svc actually makes this worse by itself.  I do
agree that when we look at the proposal for adding additional allowed
server certs to a connection that this will certainly be something we'll
want to discuss in more detail (although that is also orthogonal from
Alt-Svc).

A general point (which goes as much to UI behavior as anything) is that the
Secure Connection Info tab in many browsers only shows the CN and buries
the SANs below what users might normally see.  (And even in today's world,
resources embedded in pages are also typically not something users see and
provide many opportunities for active linking of users, such as through
URIs.)

       Erik

(resending with some edits from an email address hopefully on the list ACL)