Subject: Improved Client Identification

From: Sanel Mesinovic <[email-masked]>
Date: Fri, 20 Feb 2015 15:36:14 +0000

Hello,

I found your email address here <https://httpwg.github.io/about/policies/>.
Have one small contribution / request to make to the new HTTP 2 protocol.
Already wrote an email long time ago to Tim Berners Lee however no reply.
Maybe someone already during this time already raised the issue.

In my opinion the new protocol should introduce a better way to uniquely
identify the client. Currently it is not possible to uniquely identify a
user. IP identification is not reliable. There can be two or more users
behind the same IP. Session identification is even worse.

There are many advantages of using better identification:

a.) web analytics could track unique visitors per time period much more
accurately
b.) tracking user activity in apps e.g. not allowing the same user to like
the page if he has already clicked the Like / Vote button
c.) law enforcement could much easier prove who was the culprit behind the
criminal activity
d.) other reasons

In my vision the protocol should allow the server side to ask or the client
side to send the system data to the server. There could be two scenarios:

1.) The server could specify that the browser must provide the UNIQUE DATA
2.) The client could send the UNIQUE DATA by using javascript.

The definition of what is UNIQUE DATA could be:

a.) hardware component serial numbers but it might be too invasive e.g. HDD
= *5QE0RCHD* , MAC address = *01:23:45:67:89:ab*
b.) an agreed hash over serial numbers of the hardware components e.g. MAC
+ HDD  e.g. MD5 / SHA1 => *bb137c684f8a89e77ad09c101ec07ade*
c.) other solution

The suggestion does not have to use HDD or MAC address. Could be a
combination of more or other hardware components.

The unique data transmitted to the server could be stored in a newly
defined Header of the HTTP2 protocol.

It would be the Browser's responsibility to get the system data, specify
the UNIQUE DATA and add it to the HTTP request.

Looking forward to hearing from you.

Best regards,

Sanel Mesinovic

-- 
Sanel Mesinovic
Software Engineer
YMC AG
Sonnenstrasse 4
8280 Kreuzlingen
Switzerland

Web http://www.ymc.ch/en/author/sanel-mesinovic

---

From: Andrew Mulholland <[email-masked]>
Date: Wed, 4 Mar 2015 14:43:37 -0500

> c.) law enforcement could much easier prove who was the culprit behind the
Whether or not these are advantages depends on your perspective.
I'm not convinced that these are sufficiently good enough reasons to expose
more data about an individual.

> In my vision the protocol should allow the server side to ask or the
> client side to send the system data to the server. There could be two
> scenarios:
>

Herein lies the flaw with such a setup.
If you are trusting a remote system for which you have no control over to
provide data that you use to define a trust relationship, or for
identification purposes, then essentially you have no control over the data
at all.

Of course perhaps people with nothing to hide are exposing more than
before, so it's not great for them from a privacy perspective.

Perhaps I've something to hide, so through the use of a browser plugin,I
ensure my browser returns random data for these, or perhaps spoofs the
identity of another...

Similarly perhaps I/you accidentally were to browse to a server hosted by
an untrustworthy entity, who then sells lists of "unique data" which could
be use by others to spoof identity.

The existing ways are for sure not perfect, but they do not rely solely on
user provided information to establish identity, and I fail to see how this
'Unique Data' can be any more accurate than a randomly generated UUID
stored in a session cookie.

best wishes

Andrew

---

From: Cory Benfield <[email-masked]>
Date: Thu, 5 Mar 2015 09:43:35 +0000

On 20 February 2015 at 15:36, Sanel Mesinovic <[email-masked]> wrote:
> Hello,
>
> I found your email address here. Have one small contribution / request to
> make to the new HTTP 2 protocol. Already wrote an email long time ago to Tim
> Berners Lee however no reply. Maybe someone already during this time already
> raised the issue.

Unfortunately, HTTP/2 is now complete, which means this request is out
of scope for HTTP/2. You could make this request as a generic HTTP
extension, however I don't recommend it.

> behind the same IP. Session identification is even worse.

Why?

Setting a cookie absolutely does uniquely identify a client, unless
the client chooses to remove it. It also does not allow correlation
across origins. For that reason, I have to assume that the following
motivations apply to this request:

- you'd like to be able to uniquely identify a client across multiple domains
- you'd like to prevent clients from being able to opt out of tracking

I'd say that either one of these is in violation of IETF BCP 188[0],
though I admit to that being a slightly broader reading of BCP 188
than is common. IMO, clients should always be able to choose not to be
tracked, and they should certainly be free from any form of
cross-domain tracking. There is a reason that people are uncomfortable
with the way the Facebook 'like' button can be used to track users as
they move around the web: adding an easier tools to do it would not
make people happier, safer or more free.

I am confident the IETF and this WG would never dream of adding such
functionality.

[0]: https://tools.ietf.org/html/bcp188

---

From: "Chris Seal (HWEL - 3 Solutions - Technology Manager)" <[email-masked]>
Date: Thu, 05 Mar 2015 13:03:37 +0000

I¹d agree that this would go against BCP188.

Arguably it¹s already possible without the need for anything new.  See
https://panopticlick.eff.org/
and
https://panopticlick.eff.org/browser-uniqueness.pdf

Chris

>[0]: https://tools.ietf.org/html/bcp188

Please consider the environment before printing this email
________________________________
This e-mail is only intended for the person(s) to whom it is addressed and may contain PRIVILEGED or CONFIDENTIAL information. Any opinions or views are personal to the writer and do not represent those of Hutchison Whampoa (Europe) Limited, Hutchison Whampoa Limited or its group companies. If you are not the intended recipient, you are hereby notified that any use, retention, disclosure, copying, printing, forwarding or dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify the sender immediately. Hutchison Whampoa (Europe) Limited is a company registered in England and Wales with company number 1923041. Registered Office: Hutchison House, 5 Hester Road, Battersea, London. SW11 4AN. www.hutchisonwhampoa.com<http://www.hutchison-whampoa.com>