Re: Alt-Svc Privacy Concerns

[Phil Lello <[e-mail]>]

This is a slightly different issue than the described scenario, and I'm far
from certain that the risks are adequately highlighted there.

"By using unique names, servers could conceivably track client requests."
seems incredibly weak to the point of being dismissive, since it suggests a
per-client hostname being generated, and that it's incredibly unlikely
anyone would bother.

IMHO, it's quite likely that multiple seemingly unrelated sites operated by
the same entity might legitimately converge users to a common servername.
It's quite likely that at this point that the user agent would see these as
candidates for sharing the same connection. It seems reasonable that there
should at least be a recommendation for a user agent to warn users that
there is significant potential for being tracked, and gain consent.

On Sat, Apr 9, 2016 at 6:51 PM, Martin Thomson <[e-mail]>
wrote:

> On 9 April 2016 at 14:41, Phil Lello <[e-mail]> wrote:
> > I'm concerned that Alt-Svc, especially used like this, is re-introducing
> the
> > sort of privacy issues people have been trying to eliminate with cookies
> for
> > years. Appologies if this has already been discussed and I missed it.
>
> http://httpwg.org/http-extensions/alt-svc.html#tracking
>