From: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
To: sameer <sameer@c2.net>
Message Hash: 79f676340fb816e181ab2fd6522fe261a9b89067c29900f926d4bfcc0ccecddd
Message ID: <c=MX%a=%p=BANACCI%l=CENTRALES/BARRANCA24/000161B1@mex3976bcaop1.banamex.com>
Reply To: _N/A
UTC Datetime: 1997-04-14 20:52:03 UTC
Raw Date: Mon, 14 Apr 1997 13:52:03 -0700 (PDT)
From: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
Date: Mon, 14 Apr 1997 13:52:03 -0700 (PDT)
To: sameer <sameer@c2.net>
Subject: Re: SSL weakness affecting links from pa
Message-ID: <c=MX%a=_%p=BANACCI%l=CENTRALES/BARRANCA24/000161B1@mex3976bcaop1.banamex.com>
MIME-Version: 1.0
Content-Type: text/plain
> GET forms aren't the only thing wrong with referer, btw. An
>associate of mine discovered some prioprietary Netscape information
>from the Referer: headers on hits to his website from Netscape
>employees, even.
Could you elaborate?
----------
From: sameer
To: ARTURO GRAPA YSUNZA; Tom Weinstein
Cc: toto@sk.sympatico.ca; cypherpunks@toad.com; stewarts@ix.netcom.com;
markm@voicenet.com; AGRAPA@k2.banamex.com; cryptography@c2.net
Subject: Re: SSL weakness affecting links from pa
Date: Monday, April 14, 1997 2:23PM
Microsoft Mail v3.0 IPM.Microsoft Mail.Note
De: sameer
Para: ARTURO GRAPA YSUNZA
Tom Weinstein
Cc: toto@sk.sympatico.ca
cypherpunks@toad.com
stewarts@ix.netcom.com
markm@voicenet.com
AGRAPA@k2.banamex.com
cryptography@c2.net
Asunto: Re: SSL weakness affecting links from pa
Fecha: 1997-04-14 14:23
Prioridad: 3
Ident. del mensaje: A7705E17CEB1D011AF91006097838CEB
-----------------------------------------------------------------------
----- --
> information. This is a security hole in the web site, not in the
> browser. The browser follows the HTTP specification. If you have a
[. . .]
>
> In the eyes of some, the referer header is a privacy violation. It
> allows a site to see what site you visited before coming there. In the
> case of Navigator, we ONLY send the referer header when you click on a
> link. Not when you select a bookmark. Not when you type a URL into the
> location field. This allows web sites to see who links to them. I
> think that's something that a web author is entitled to know.
GET forms aren't the only thing wrong with referer, btw. An
associate of mine discovered some prioprietary Netscape information
from the Referer: headers on hits to his website from Netscape
employees, even.
I commend Netscape for providing users with the ability to
turn off referers.
--
Sameer Parekh Voice: 510-986-8770
President FAX: 510-986-8777
C2Net
http://www.c2.net/ sameer@c2.net
Return to April 1997
Return to “sameer <sameer@c2.net>”