Subject: Re: [httpwg/http-extensions] Accept-CH-Lifetime privacy concerns (#372)

From: HTTP issue updates <[email-masked]>
Date: Mon, 27 Nov 2017 16:52:35 +0000 (UTC)

Thanks, Ilya! I re-read the spec with your changes and I also think it's a significant improvement, particularly when it comes to binding subresource hints to the opt-in origin, hindering cross-origin linking between 1p sites which don't use `Accept-CH`.

My main outstanding worry is indeed the "hint delegation" issue you mentioned above: specifically, the fact that opting an origin into receiving hints still results in sending hints on subresources by default if the 3p also opts in, potentially giving it information about the referring page that it wouldn't currently receive. Similarly, such 3p origins hosting subresources used by an `Accept-CH`-enabled origin would start getting hints which disclose a few bits of information about the user and could be used for opportunistic linking across 1p visits to different `Accept-CH`-enabled origins.

I like the idea of using Feature Policy to control this, but it's doubtful that developers would understand the privacy benefit of restricting subresource hints via FP, which means they wouldn't take action to prevent them from being sent. What do you think about flipping this around and only sending hints on 3p subresource requests if the origin is explicitly whitelisted via Feature Policy? This would be a direct signal from the developer that they want to trust the third-party, and might be more in line with the interests of both the first-party and the user.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/372#issuecomment-347245677

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 27 Nov 2017 17:07:22 +0000 (UTC)

> What do you think about flipping this around and only sending hints on 3p subresource requests if the origin is explicitly whitelisted via Feature Policy? This would be a direct signal from the developer that they want to trust the third-party, and might be more in line with the interests of both the first-party and the user.

I'd be supportive of restricting third party access by default and providing a Feature Policy explicit opt-in to specific third-party domains that the origin trusts. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/372#issuecomment-347251182