diff options
Diffstat (limited to 'proposals/0000-session-data-extension.md')
| -rw-r--r-- | proposals/0000-session-data-extension.md | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/proposals/0000-session-data-extension.md b/proposals/0000-session-data-extension.md index d7cffa9..659e70d 100644 --- a/proposals/0000-session-data-extension.md +++ b/proposals/0000-session-data-extension.md @@ -43,7 +43,9 @@ After publishing this DEP, the "Beaker Browser" will implement a Web API for exp # Drawbacks [drawbacks]: #drawbacks -This DEP may present privacy concerns, as it may be used to track users in a similar fashion to HTTP Cookies. +- This DEP may present privacy concerns, as it may be used to track users in a similar fashion to HTTP Cookies. +- The payload of the `'session-data'` message is not authenticated in any way. If a public key is sent, proof of ownership of the private key is not provided. The lack of trust must be considered by applications which leverage the data. +- If the recipient of the `'session-data'` message is not authenticated (as is currently the case in all Dat replication connections) the client will not know who is receiving the payload and may broadcast sensitive information. # Rationale and alternatives |