[saag] Re: Covert Web-to-App Tracking via Localhost

Michael Richardson <[email protected]> Wed, 04 Jun 2025 16:38:07 -0400

Newsgroups	gmane.ietf.saag
Message-ID	<[email protected]>

John, this "localmess" seems to be about "native" apps that listen on
127.0.0.1, to which mobile browers seem not to filter access, or restrict.
Seems very serious to me.  

(Don't install apps to which one can not review/audit their source code. But,
that's never been a IETF responsability)

****
I don't see how this an IETF *specific* concern, nor do I see how this is
enabled by any current IETF process or policy.
****

Maybe we don't need an app for every unique interaction, maybe we need e2e
informational models for IoT and the like.  The IETF is already the lead here.

John Mattsson <[email protected]> wrote:
    > I urge the broader Internet community to reevaluate current approaches,
    > and to prioritize user privacy and safety over monetary donations from
    > data-hoarding, surveillance-driven tech giants.

Except that maybe we shouldn't accept statements like "TLS 1.3 in widely
deployed", yet it's only really browsers, and they (browsers) don't seem to
support useful TLS features like mutual authentication with 1.3.
The HTTP client authentication gap is a problem that seems to be nobody's problem.

-- 
Michael Richardson <[email protected]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 515 B)