3 ms·
Wouldn't 0RTT be safe for GET requests that doesn't contain cookies or private data? Granted I suppose such interpretation would have to be done by browsers.
by jopsen 9y ago
Wouldn't 0RTT be safe for GET requests that doesn't contain cookies or private data?
Granted I suppose such interpretation would have to be done by browsers.
And even then it could be used to figure out which site you are visiting.
- valarauca1 9y agoYou are assuming * The TLS connection is instantly closed after the GET ends * A new 0RTT ticket isn't created * No session information is transmitted (most GET's even have session information for ads/metrics).