Re:Encrypted SNI Comes to Firefox Nightly
by kardos on Thursday October 18, 2018 @04:43PM
(#18251942)
> with the standard setting of the session resumption lifetime in many current browsers
> seven days, as recommended upper limit
Do we fix this by changing that setting to a few hours?
Edit: the report discusses this: "The recommended upper limit of the session resumption lifetime in TLS 1.3 [19] of seven days should be reduced to hinder tracking based on this mechanism. We propose an upper lifetime limit of ten minutes based on our empirical observations"
Is this a configurable option in Firefox?
Re:Encrypted SNI Comes to Firefox Nightly
by phaer on Thursday October 18, 2018 @06:15PM
(#18252633)
The links to the full paper in your second link led me to a 404 page. Found it here: https://svs.informatik.uni-hamburg.de/publications/2018/2018...
looks interesting, thanks!
"Tracking Users across the Web via TLS Session Resumption"[1]. A snippet from the abstract: "Our results indicate that with the standard setting of the session resumption lifetime in many current browsers, the average user can be tracked for up to eight days. With a session resumption lifetime of seven days, as recommended upper limit in the draft for TLS version 1.3, 65% of all users in our dataset can be tracked permanently."
Not exactly looking forward to TLS1.3, it appears to be a move forward in security but with no (or worse) privacy benefits that I've seen so far.
[0]https://twitter.com/durumcrustulum/status/105293632402455757...
[1]http://front.math.ucdavis.edu/1810.07304