Subject: Tracking through cache abuse

From: Bjoern Hoehrmann <[email-masked]>
Date: Mon, 25 Jul 2011 20:54:05 +0200

Hi,

  http://tools.ietf.org/html/draft-ietf-httpbis-p6-cache-15 currently
does mention that "Because cache contents persist after an HTTP request
is complete, an attack on the cache can reveal information long after a
user believes that the information has been removed from the network",
but does not seem to address privacy issues that go along with that.

"Evercookie" for instance abuses the ETag header as tracking mechanism,
and specially crafted cached resources to the same end; others abuse 301
redirects, and there are other features that can be abused this way. The
draft should note this as a general problem and cite some of the things
we know about as examples.

regards,
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 25 Jul 2011 14:58:24 -0400

Hi Bjoern,

Can you suggest text? Seems it would need to be in p2 (redirects), p4 (conditional) as well as p6 (caching).

Cheers,

--
Mark Nottingham   http://www.mnot.net/

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Mon, 25 Jul 2011 19:27:23 +0000

In message <[email-masked]>, Bjoer

>we know about as examples.

There is a very important difference between second and third party
attacks we should make clear here.  The first paragraph talks about
a 3rd party exploitable privacy leak, the second paragraph talks about
a 2nd party deliberate privacy break.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.