Repository navigation
Correct tracking text - #146
Merged
Merged
Conversation
The old text told implementations to avoid long-lived, globally unique identifiers. Providing one is what this protocol does, so the advice contradicted the rest of the draft. Replace the three privacy subsections with one. It says receivers can correlate requests carrying the same identifier, across origins too, and that key rotation changes nothing while the URL stays the same. The human binding guidance from webbotauth#114 moves there as well: an identifier tied to one person exposes them to that correlation, so the protocol is not suited to it. The SHOULDs are dropped, as a conforming agent could not meet them. Closes webbotauth#115
sandormajor
approved these changes
Oct 21, 2026
|
LGTM but let's see if @martinthomson agrees. Maybe we could even compress the two paragraphs into one. |
Collaborator
Author
|
will be on the list as well |
martinthomson
approved these changes
Oct 22, 2026
martinthomson
left a comment
martinthomson
left a comment
There was a problem hiding this comment.
LGTM, thanks. (Note: lots of noise on GitHub lately, but I do try to find at-mentions; flag me if you think I'm being too slow.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This updates the text by making it clear it allows for correlation, including possible continuity across key rotation. While at it, updates the no human correlation guidance from #114 to describe the privacy risk more plainly.
Overall, it allows to remove quite soe text that was convoluted.
Closes #115 #114
@sandormajor