Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284)

From: HTTP issue updates <[email-masked]>
Date: Tue, 31 Jan 2017 12:38:25 -0800

To be clear this would both decrease fingerprinting surface (by not having clients send these hints when they're not needed -- a data minimization practice) *and* increase detectability of client fingerprinting (researchers can see that fingerprinting might be happening because of observable server behavior). I would support this requirement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/284#issuecomment-276484697

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 31 Jan 2017 17:01:52 -0800

There is still the possibility that an embedded third-party sends the Accept-CH and uses the hints for drive-by fingerprinting. IMO UAs should ignore Accept-CH from embedded third-party sub-resources unless DNT:0 .

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/284#issuecomment-276543392