cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1997-04-14 - Re: SSL weakness affecting links from pa

Header Data

From: sameer <sameer@c2.net>
To: tomw@netscape.com (Tom Weinstein)
Message Hash: ce6a5f36705e9d342e05c48fe5585d7795e1e6f0aeb67d1f656528a8e57ae836
Message ID: <199704141942.MAA15317@gabber.c2.net>
Reply To: <3351F2DF.7DC26A1A@netscape.com>
UTC Datetime: 1997-04-14 19:43:14 UTC
Raw Date: Mon, 14 Apr 1997 12:43:14 -0700 (PDT)

Raw message

From: sameer <sameer@c2.net>
Date: Mon, 14 Apr 1997 12:43:14 -0700 (PDT)
To: tomw@netscape.com (Tom Weinstein)
Subject: Re: SSL weakness affecting links from pa
In-Reply-To: <3351F2DF.7DC26A1A@netscape.com>
Message-ID: <199704141942.MAA15317@gabber.c2.net>
MIME-Version: 1.0
Content-Type: text/plain


> information.  This is a security hole in the web site, not in the
> browser.  The browser follows the HTTP specification.  If you have a
[. . .]
> 
> In the eyes of some, the referer header is a privacy violation.  It
> allows a site to see what site you visited before coming there.  In the
> case of Navigator, we ONLY send the referer header when you click on a
> link.  Not when you select a bookmark.  Not when you type a URL into the
> location field.  This allows web sites to see who links to them.  I
> think that's something that a web author is entitled to know.

	GET forms aren't the only thing wrong with referer, btw. An
associate of mine discovered some prioprietary Netscape information
from the Referer: headers on hits to his website from Netscape
employees, even.

	I commend Netscape for providing users with the ability to
turn off referers.

-- 
Sameer Parekh					Voice:   510-986-8770
President					FAX:     510-986-8777
C2Net
http://www.c2.net/				sameer@c2.net

Thread