Subject: More cookies

From: Martin Thomson <[email-masked]>
Date: Tue, 11 Dec 2012 14:29:41 -0800

I think that perhaps the following clause, which appears to be a
throwaway, needs an issue to track it.

""A SETTINGS frame [...]. When the server is the sender, the sender
can request that configuration data be persisted by the client across
SPDY sessions and returned to the server in future communications.""

The concern here is that this provides another mechanism by which
servers are able to track clients.

For the browser guys who have implemented this: What controls, if any,
are offered to users over this data?  Are users able to clear the
store?  Are there limits on settings storage?  Do you have any data on
the value of having clients persist settings?

It occurs that it might be possible to verify that a client has a
particular settings configuration without having them echo the
settings and thereby provide another cookie channel.  I hear that hash
algorithms are good for this sort of thing.

---Martin

---

From: Patrick McManus <[email-masked]>
Date: Tue, 11 Dec 2012 17:59:08 -0500

> the value of having clients persist settings?

For these reasons Firefox doesn't generically implement this as a cookie.
We will implement particular settings values that are documented and are in
reasonable ranges without enough room for fingerprinting although none are
deployed in any of the release channels and life goes on just fine. For
instance I'm working on a patch for ID 5 right now and will mask it limit
it to a range of a hundred values or so and won't persist that one between
restarts... it will have to prove itself out with data before getting to
the release channel to stay in the code base though it isn't hard to find
synthetic uses for it.

I agree that some language around that is probably a good thing.

---

From: Martin Thomson <[email-masked]>
Date: Tue, 11 Dec 2012 15:17:59 -0800

On 11 December 2012 14:59, Patrick McManus <[email-masked]> wrote:
> without enough room for fingerprinting [...]  a hundred values or so

Some folks in the W3C were concerned that WebRTC could leak as much as
two bits in Javascript.  A passive fingerprint surface with 6 or 7
bits might raise some alarms.  Oh well, just making this known so that
we can track it.  In any case, no need to solve this right now.