There are features that go back a ways in TLS that someone could use for tracking. A while back I wrote a quick and dirty POC for using TLS 1.2 session resumpt

There are features that go back a ways in TLS that someone could use for tracking. A while back I wrote a quick and dirty POC for using TLS 1.2 session resumption for sub-NAT user tracking[1]. While it is really effective at separating out multiple different users interacting with a server from behind a NAT, I'm not sure these features are usable for cross site tracking. I'm not familiar with 0-RTT but sessions resumption scoped tickets to a host so it wouldn't be useful there. While someone could use it for some tracking purposes it really is a huge performance boon. There are good intentions on why these features were put in even if they can be abused. 1. https://stuartsmall.com/tlsslides.odp https://stuartsmall.com/tlsslides.odp https://github.com/stusmall/rustls/commit/e8a88d87a74d5630227ea330cc4bf3fae8727b8e https://github.com/stusmall/rustls/commit/e8a88d87a74d563022...