From 4c8fd4ca6c4bb0972b95c8892cfa9d65ec55a8c9 Mon Sep 17 00:00:00 2001 From: Thibault Meunier Date: Tue, 13 Oct 2026 14:22:30 -0700 Subject: [PATCH] [protocol] state plainly that identifiers allow correlation The old text told implementations to avoid long-lived, globally unique identifiers. Providing one is what this protocol does, so the advice contradicted the rest of the draft. Replace the three privacy subsections with one. It says receivers can correlate requests carrying the same identifier, across origins too, and that key rotation changes nothing while the URL stays the same. The human binding guidance from #114 moves there as well: an identifier tied to one person exposes them to that correlation, so the protocol is not suited to it. The SHOULDs are dropped, as a conforming agent could not meet them. Closes #115 --- draft-ietf-webbotauth-httpsig-protocol.md | 30 +++++++---------------- 1 file changed, 9 insertions(+), 21 deletions(-) diff --git a/draft-ietf-webbotauth-httpsig-protocol.md b/draft-ietf-webbotauth-httpsig-protocol.md index edf7763..bdd2ad7 100644 --- a/draft-ietf-webbotauth-httpsig-protocol.md +++ b/draft-ietf-webbotauth-httpsig-protocol.md @@ -817,29 +817,17 @@ to treat unsigned requests differently nor gives it grounds to. # Privacy Considerations {#privacy-considerations} -## Public Identity +## Identification and Correlation -This protocol assumes that automated clients identify themselves -explicitly using digital signatures. The identity associated with a signing -key is expected to be publicly discoverable for verification purposes. This -reduces anonymity and allows receivers to associate requests with specific -agents. If an agent wishes not to identify itself, this is not the right -choice of protocol for it. +This protocol enables receivers to recognise requests that carry the same +identifier and to correlate them, including across origins. Key rotation does +not prevent this correlation when the identifier remains unchanged +({{rotation}}). This protocol is unsuitable for agents that need to avoid such +identification. -## No Human Correlation - -A key tied to a specific human individual exposes personally identifiable -information and makes the key usable for user tracking or profiling. A key that -represents a role, company, or automation identity (e.g., "news-aggregator-bot", -"example-crawler-v1") avoids this. - -## Minimizing Tracking Risks - -To limit tracking risks, implementations SHOULD avoid long-lived, globally -unique key identifiers unless strictly necessary. Key rotation SHOULD be -supported, and clients SHOULD take care to avoid signing information that -could be used to correlate activity across contexts, especially where -sensitive user data is involved. +Agents whose identifier would be associated with an individual human, rather +than a service or role, expose that person to the same correlation. This +protocol is not suited to such deployments. ## Directory Content and Access Patterns