Subject: Re: A question about user tracking with QUIC

From: Mirja Kuehlewind <[email-masked]>
Date: Wed, 14 Jul 2021 17:00:49 +0000

Hi Stephane,

I just found this older mail and didn't really see a reply, so here a quick note:

You are right that it's really hard to avoid tracking completely, just because if one flow stops sending to server but that the same time another flow starts sending with the same "speed" it likely that it is actually the same flow.

Maybe a few notes on this are in the manageability document here:

https://datatracker.ietf.org/doc/html/draft-ietf-quic-manageability-11#section-3.5

Not sure what else to say...

Mirja

On 07.06.21, 14:39, "QUIC on behalf of Stephane Bortzmeyer" <[email-masked] on behalf of [email-masked]> wrote:

    I was thinking about the privacy risks of QUIC and there is one where
    I'm not sure what to think of it, and for which I cannot find any
    discussion in the archives of the WG.

    Long-term QUIC connections may enable some user tracking, even when
    the user changes its IP address, without even needing HTTP cookies or
    things like that.

    I am not sure it is a real problem in practice because it's not new
    (HTTP/2 offered similar possibilities), there are many other ways to
    track users (HTTP cookies, browser fingerprinting, Google Analytics),
    and they even work cross-servers. But it can be a problem for
    privacy-oriented technologies (QUIC cannot currently work over Tor but
    may be in the future?)

    I do not find discussions about that. Was it considered? (If so, you
    are welcome to reply "Search with mailarchive yourself" but I prefer
    if it comes with URLs and/or approximate datetimes.) Is it, for
    instance, a good idea to advise privacy-oriented clients to always
    shut down QUIC connections when IP address changes?

---

From: Mirja Kuehlewind <[email-masked]>
Date: Wed, 14 Jul 2021 17:07:35 +0000

Okay, I have to admit that I don't know who to use my mail client correctly and I've now seen that there are many replies. However, I hope the pointer to the manageability draft is still somewhat helpful...

On 14.07.21, 19:01, "QUIC on behalf of Mirja Kuehlewind" <[email-masked] on behalf of mirja.kuehlewind=[email-masked]> wrote:

    Hi Stephane,

    Mirja