Subject: [v6ops] new draft: draft-vyncke-v6ops-happy-eyeballs-cookie

From: [email-masked]
Date: Wed, 29 Oct 2014 08:14:20 -0700

A new draft has been posted, at http://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie. Please take a look at it and comment.

---

From: Jeroen Massar <[email-masked]>
Date: Wed, 29 Oct 2014 16:26:44 +0100

> A new draft has been posted, at http://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie. Please take a look at it and comment.

Any site which restricts the cookie by IP will have been broken by one of:
 - NAT
 - Multiple IPs for outbound HTTP proxies
 - mobile devices that move around etc etc etc..
 - CGN/AFTR/etc

Hence, how is this Happy Eyeball specific?

It is common sense to not lock a cookie down to the IP.

The IP can be shared, because of above, thus it won't help to lock it
down that way.

Of course, from a security perspective that is bad, but that is how the
world works. HTTPS should solve the problem of any cookie stealing; if
people get in to the site or browser/client, the IP lockdown does not help.

If anything, this should just be an errata/addon for:
http://tools.ietf.org/html/rfc6265

Greets,
 Jeroen