{"action":"created","issue":{"url":"https://api.github.com/repos/tlswg/draft-ietf-tls-esni/issues/146","repository_url":"https://api.github.com/repos/tlswg/draft-ietf-tls-esni","labels_url":"https://api.github.com/repos/tlswg/draft-ietf-tls-esni/issues/146/labels{/name}","comments_url":"https://api.github.com/repos/tlswg/draft-ietf-tls-esni/issues/146/comments","events_url":"https://api.github.com/repos/tlswg/draft-ietf-tls-esni/issues/146/events","html_url":"https://github.com/tlswg/draft-ietf-tls-esni/issues/146","id":417321089,"node_id":"MDU6SXNzdWU0MTczMjEwODk=","number":146,"title":"User tracking via ESNI keys","user":{"login":"kirsey","id":6534072,"node_id":"MDQ6VXNlcjY1MzQwNzI=","avatar_url":"https://avatars3.githubusercontent.com/u/6534072?v=4","gravatar_id":"","url":"https://api.github.com/users/kirsey","html_url":"https://github.com/kirsey","followers_url":"https://api.github.com/users/kirsey/followers","following_url":"https://api.github.com/users/kirsey/following{/other_user}","gists_url":"https://api.github.com/users/kirsey/gists{/gist_id}","starred_url":"https://api.github.com/users/kirsey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kirsey/subscriptions","organizations_url":"https://api.github.com/users/kirsey/orgs","repos_url":"https://api.github.com/users/kirsey/repos","events_url":"https://api.github.com/users/kirsey/events{/privacy}","received_events_url":"https://api.github.com/users/kirsey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2019-03-05T14:18:34Z","updated_at":"2019-03-08T00:10:09Z","closed_at":null,"author_association":"NONE","body":"If each client receives a unique ESNI key from a DNS provider, it is possible to link every usage of this key to the same client. It seems feasible that online services, as well as passive observers of the network traffic, can exploit such a practice for user tracking.\r\n\r\nTo enhance the privacy protections of this draft, we should describe these privacy risks in the draft. Furthermore, I recommend a clear restriction on the clients’ caching durations of ESNI keys. For example, clients MUST NOT cache ESNI keys longer than 24 hours and as privacy protection, it is RECOMMENDED to cache ESNI keys only for 10 minutes."},"comment":{"url":"https://api.github.com/repos/tlswg/draft-ietf-tls-esni/issues/comments/470752402","html_url":"https://github.com/tlswg/draft-ietf-tls-esni/issues/146#issuecomment-470752402","issue_url":"https://api.github.com/repos/tlswg/draft-ietf-tls-esni/issues/146","id":470752402,"node_id":"MDEyOklzc3VlQ29tbWVudDQ3MDc1MjQwMg==","user":{"login":"kontaxis","id":6628990,"node_id":"MDQ6VXNlcjY2Mjg5OTA=","avatar_url":"https://avatars3.githubusercontent.com/u/6628990?v=4","gravatar_id":"","url":"https://api.github.com/users/kontaxis","html_url":"https://github.com/kontaxis","followers_url":"https://api.github.com/users/kontaxis/followers","following_url":"https://api.github.com/users/kontaxis/following{/other_user}","gists_url":"https://api.github.com/users/kontaxis/gists{/gist_id}","starred_url":"https://api.github.com/users/kontaxis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kontaxis/subscriptions","organizations_url":"https://api.github.com/users/kontaxis/orgs","repos_url":"https://api.github.com/users/kontaxis/repos","events_url":"https://api.github.com/users/kontaxis/events{/privacy}","received_events_url":"https://api.github.com/users/kontaxis/received_events","type":"User","site_admin":false},"created_at":"2019-03-08T00:10:09Z","updated_at":"2019-03-08T00:10:09Z","author_association":"NONE","body":"The document already sets the maximum TTL to the lifetime of the SNI key.\r\nIt also recommends that \"servers rotate keys frequently\" to reduce the harm from compromised keys.\r\n\r\nSo it seems that short-lived keys are good both for security and privacy.\r\n\r\nA recommended value would be useful. Otherwise \"frequently\" could be interpreted as months."}}
{"actor":{"display_login":"kontaxis"}}