I wasn't attempting to dogpile, and am sorry if it came across that way. I agree that this scheme would, if used as a replacement for cookies in the manner des

I wasn't attempting to dogpile, and am sorry if it came across that way. I agree that this scheme would, if used as a replacement for cookies in the manner described by the OP, be a strict improvement on the current state. That's the first step in evaluating a proposed privacy improvement. However, that is only sufficient if you already trust the operator of the server to maintain that same implementation. That may work for some threat models, such as a website that is currently run by a trusted individual that may later be bought by a malicious actor, but it isn't sufficient in all cases. Across the entire ecosystem, there's a sequence of questions that needs to be asked. 1. How would a non-malicious actor implement the proposed system? 2. What is the minimal amount of information that must be provided for a non-malicious actor to benefit from the proposed system? 3. What could a malicious actor do with that minimal amount of information? 4. If a malicious actor could use this information, are there additional steps the user can take to mitigate those effects? Together, these questions help to predict the effects of the proposed implementation becoming the standard. Applying it to this article: 1. As described in the original post. 2. The browser must cache files according to the cache policy requested, and the browser provides accurate information about its cache for subsequent requests. 3. Answered in previous comments, that malicious actors could use this to reproduce the same information as is stored in cookies. 4. I'm not sure yet, but I'm picturing an approach where the "if-modified-since" header is deliberately varied for some requests, and abnormal results cause the caching policy of that website to be ignored as untrustworthy. When people try to figure out what malicious acts could be done, it's moving the conversation from the first two questions and toward the last two questions. It isn't malicious, or reading into the original poster's intentions, but is an attempt to predict what malicious actions will eventually occur, and to implement mitigations as soon as possible.