Subject: Re: [httpwg/http-extensions] Allow servers to specify max-age in the client hints header (#306)

From: HTTP issue updates <[email-masked]>
Date: Mon, 27 Feb 2017 09:25:51 -0800

It crossed my mind also that the response determines a future request, so how long in the future?

Why not create a well-known named cookie, similar to the cookie prefix idea in RFC6265bis, then use that to convey Accept-CH. Then you get the potential fingerprinting showing up in the cook,ie store where the user (or privacy extensions) can see it. You also get the expiry functionality  for free. 

And the SameSite attribute to help with privacy.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/306#issuecomment-282788867

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 27 Feb 2017 10:12:15 -0800

@michael-oneill I am not sure if cookies are the best place to store this information given that cookies are used by servers for state management, and this does not seem to fit that use case.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/306#issuecomment-282801985

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 28 Feb 2017 01:51:36 -0800

Accept-CH makes the UA retain the state on what Client Hints are to be sent in future requests. The problem with Client Hints is that they can (will) be used to identify users by fingerprinting their UAs. 

Users know to some extent that cookies are used to identify them, so why not hold this identifying styate their also.

It increases transparency,, enables user control and does not re-invent the wheel.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/306#issuecomment-282993375