[11542] in www-talk@info.cern.ch
Re: Security: Cookies
daemon@ATHENA.MIT.EDU (Antoni Matheu)
Mon Mar 20 02:12:34 2000
Message-Id: <200003200708.IAA27843@ati.es>
From: "Antoni Matheu" <amatheu@ati.es>
To: "Joris Dobbelsteen" <j.p.tdobbelsteen@freeler.nl>
Date: Mon, 20 Mar 2000 08:07:35 +0100
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Reply-To: amatheu@retemail.es
Cc: www-talk@w3.org
In-Reply-To: <000201bf912b$7fd2b5c0$0d0aa8c0@Thuis.local>
Resent-From: www-talk@w3.org
Content-Transfer-Encoding: quoted-printable
> Last I heard about privacy violation by use of cookies:
> - They should provide a web server with personal information about you
> - provide Web Server Administrators (and authorized users) with informa=
tion
> about the web server usage from a specific user or all users.
>=20
> The guy was on the radio and complained cookies where a real violation =
to
> his privacy and turned it off, also he said servers should announce tha=
t
> they are using cookies. RFC 2616 (HTTP/1.1 - June 1999) and another doc=
ument
> discussing HTTP/1.1 did not mension cookies, and they don't see to be
> standard (???) or this is part of HTML (???).
>=20
> I desided that monitoring what users like can be done much easier by lo=
gging
> the links clicked (redirection) and using counters.
> Maybe other HTTP/1.1 parts provide much greater security vulabilities:
> user-agent, server, via, from, etc.....
>=20
> Can I have some more info about this???
>=20
I think that cookies do not send any information not previously=20
stored in it, and this information has been available to the server=20
by other means.
The only value of a cookie is that, as people connect usually via an=20
ISP that doesn't give them the same ip address every time, it is=20
impossible to relate a person to an ip and store information about it=20
using ip as an identifier. So you must send it a cookie and get back=20
it later.
I mean that the privacy violation resides on the use of user-agent,=20
server, via, from, etc; not the use of cookies.
Regards,
-------------------------------------+--------------------------------
Antoni Matheu |
http://vincles.minim.org |
| Encara no edites amb L'Ed ?
Promoci=F3 gratu=EFta de p=E0gines web | =BF A=FAn no editas con L'=
Ed ?
Promoci=F3n gratuita de p=E1ginas web | Not editing with L'Ed yet ?
Free web pages promotion | http://pagina.de/amatheu
-------------------------------------+--------------------------------
