Subject: Re: [quicwg/base-drafts] NEW_TOKEN token and encryption (#2543)

From: Lars Eggert <[email-masked]>
Date: Tue, 16 Apr 2019 00:58:46 -0700

@martinthomson and others, is  kazuho@9017aae kind of the editorial change you were envisioning?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543#issuecomment-483553538

---

From: Erik Sy <[email-masked]>
Date: Tue, 16 Apr 2019 01:57:16 -0700

I was asked to move #2587 here. I miss the point, that the server SHOULD NOT construct the same token multiple times because this leads to additional scenarios where tracking by a network observer becomes feasible. The referenced PR does not fix this problem.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543#issuecomment-483573184

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 16 Apr 2019 02:54:15 -0700

@kirsey 
>  I miss the point, that the server SHOULD NOT construct the same token multiple times because this leads to additional scenarios where tracking by a network observer becomes feasible. The referenced PR does not fix this problem.

I think we are in agreement that unlinkability between tokens are required. IMO the phrase "SHOULD NOT expose linkability" in the proposed text captures the concept, though I might agree that "i.e., ..." needs improvement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543#issuecomment-483592677

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 17 Apr 2019 11:19:16 -0700

@larseggert: @kazuho's change would be adequate, and I agree with @martinthomson that this is effectively editorial.  Do the chairs want to mark this issue as `editorial`?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543#issuecomment-484204779

---

From: Erik Sy <[email-masked]>
Date: Fri, 19 Apr 2019 20:51:47 +0000 (UTC)

@kazuho Yes, I agree with you on the phrase "Should NOT expose likability".
To address my concern, I suggest to include "This includes that the server constructs each time a different token when issuing tokens to clients from the same source address." after line 1560 of  #kazuho/base-drafts@9017aae.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543#issuecomment-485011159

---

From: Lars Eggert <[email-masked]>
Date: Thu, 25 Apr 2019 23:42:32 -0700

Marking this as editorial

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543#issuecomment-486944882