Re: A question about user tracking with QUIC

[Stephane Bortzmeyer <[e-mail]>]

On Mon, Jun 07, 2021 at 04:36:57PM +0200,
 Mikkel Fahnøe Jørgensen <[e-mail]> wrote 
 a message of 36 lines which said:

> > a privacy-conscious client may be better by not using connection
> > migration, and resetting to an entirely new connection when the IP
> > address changes.
> 
> You cannot do that for non-trivial protocols such as HTTP because
> you need application state that cannot be interrupted during
> migration.

Sorry, but this is not true. HTTP/2 and HTTP/1 can be interrupted, and
often are when the underlying TCP connection is reset, for instance
when the IP address changes. Typically, it is up to the application
above to deal with it.

> QUIC has a 0 connection ID that disallows migration, so you can do
> this if you want.

I must confess that I was not aware of this possibility. (Anyway, the
client can always, unilaterally, tear down the connection and start a
new one.) I think this sort of "tricks" could be interesting to write
down in a section "QUIC for very privacy-loving clients" in some
future RFC.