Subject: Re: Last Call: <draft-nottingham-safe-hint-05.txt> (The "safe" HTTP Preference) to Proposed Standard

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Nov 2014 16:16:48 +1100

Reminder: if you want an e-mail response to a message on this list, please CC: me.

Doug Barton said:

> Mark, can you respond to this point in more detail? Specifically, given 
> that there are already more-granular cookie-based solutions which are 
> nearly universally deployed, how much does preventing granularity in the 
> initial signal to the site help avoid this pitfall?

Because the hint is potentially sent on *all* requests, not just selected sites.

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Doug Barton <[email-masked]>
Date: Tue, 18 Nov 2014 09:54:58 -0800

> Because the hint is potentially sent on *all* requests, not just selected sites.

Thanks for the response. I'm not sure I find it compelling though. :-/ 
There are (roughly) three types of web sites, ones that will ignore the 
flag completely, ones that will honor it as the user intended, and ones 
that will attempt to use the information to data-mine beyond what the 
user intended. The first two we can ignore, it's the last type that's of 
concern, yes?

So what's to stop that malicious site owner from putting up a block on 
their site unless you fill out the form that tells them the PII they 
want to know? (Hint: nothing, they already do that) So either the whole 
idea of the flag is dangerous because it may reveal something to a 
malicious site that the user would not want revealed, or the idea is 
useful, and one bit is not enough granularity to make it truly compelling.

Doug

---

From: Eliot Lear <[email-masked]>
Date: Tue, 18 Nov 2014 19:43:28 +0100

On 11/18/14, 6:54 PM, Doug Barton wrote:
> want to know?

The research in this space is far from simple.  It is true that for very
little in return users will tend to share.[1]  And it is also well
established that users will overshare.[2]  And so what you say is likely
to be true IFF users gain something of value to them.  But this being
the case, I think what you're asking is actually not relevant in this
case.  Users have the option of setting or not setting a bit, and
content providers have the option of honoring or ignoring it.

Eliot
[1] Egelman, et. al, "Choice Architecture and Smartphone Privacy", WEIS
2012.
[2] Preibusch, et. al, "The privacy economics of voluntary
over-disclosure in Web forms", WEIS 2012.