From ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org Tue Feb 7 07:42:11 2023 Return-Path: X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB21BC1575A2 for ; Tue, 7 Feb 2023 07:42:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.648 X-Spam-Level: X-Spam-Status: No, score=-2.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.25, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2QUJLrwZT85T for ; Tue, 7 Feb 2023 07:42:09 -0800 (PST) Received: from lyra.w3.org (lyra.w3.org [128.30.52.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26EE3C153CBF for ; Tue, 7 Feb 2023 07:42:08 -0800 (PST) Received: from lists by lyra.w3.org with local (Exim 4.94.2) (envelope-from ) id 1pPQ6V-00C1Vo-1j for ietf-http-wg-dist@listhub.w3.org; Tue, 07 Feb 2023 15:41:55 +0000 Resent-Date: Tue, 07 Feb 2023 15:41:55 +0000 Resent-Message-Id: Received: from titan.w3.org ([128.30.52.76]) by lyra.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1pPQ6T-00C1Uw-Ew for ietf-http-wg@listhub.w3.org; Tue, 07 Feb 2023 15:41:54 +0000 Received: from welho-filter3b.welho.com ([83.102.41.29] helo=welho-filter3.welho.com) by titan.w3.org with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1pPQ6Q-00BTkF-5j for ietf-http-wg@w3.org; Tue, 07 Feb 2023 15:41:53 +0000 Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id 18DC1139ED for ; Tue, 7 Feb 2023 17:41:39 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id kAK0tzmnJKYW for ; Tue, 7 Feb 2023 17:41:38 +0200 (EET) Received: from LK-Perkele-VII2 (87-92-18-205.bb.dnainternet.fi [87.92.18.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id D59912315 for ; Tue, 7 Feb 2023 17:41:37 +0200 (EET) Date: Tue, 7 Feb 2023 17:41:37 +0200 From: Ilari Liusvaara To: HTTP Working Group Message-ID: References: <6532E43F-74FD-46B4-8D28-9DB03452A689@mnot.net> <7415fe6a-40c4-139b-af35-eb71f6ba5254@cs.tcd.ie> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <7415fe6a-40c4-139b-af35-eb71f6ba5254@cs.tcd.ie> Sender: ilariliusvaara@welho.com Received-SPF: pass client-ip=83.102.41.29; envelope-from=ilariliusvaara@welho.com; helo=welho-filter3.welho.com X-W3C-Hub-Spam-Status: No, score=-3.9 X-W3C-Hub-Spam-Report: BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1 X-W3C-Scan-Sig: titan.w3.org 1pPQ6Q-00BTkF-5j b02e1544a9d8fdb17414c04a2642aa1c X-Original-To: ietf-http-wg@w3.org Subject: Re: Call for Adoption: HTTP Unprompted Authentication Archived-At: Resent-From: ietf-http-wg@w3.org X-Mailing-List: archive/latest/50690 X-Loop: ietf-http-wg@w3.org Resent-Sender: ietf-http-wg-request@w3.org Precedence: list List-Id: List-Help: List-Post: List-Unsubscribe: On Tue, Feb 07, 2023 at 12:32:22PM +0000, Stephen Farrell wrote: > > On 07/02/2023 05:58, Mark Nottingham wrote: > > Hello everyone, > > > > We first discussed this draft at IETF114[1], saw implementation > > interest at IETF115, [2] and finally had some more list discussion. > > > > This is a Call for Adoption for: https://www.ietf.org/archive/id/draft-schinazi-httpbis-unprompted-auth-01.html > > > > Please indicate (in response to this message) whether you support > > adoption, and whether you intend to implement. > > I'm not sure. > > Can someone clarify whether the u= field amounts > to a super-cookie or not, and if not, how that > might be the case? > > If there's a good answer to the above, I'd support > adoption. If not, not. The u= is actually not username but key handle. And when it comes to tracking, the standard stuff for keys appiles: - Don't use the same key in places you don't want linked together. - If client chooses key identifiers, don't inclue any PII in those. (This is how Webauthn addresses the tracking vector.) -Ilari