3 ms·
I'm far from being versed enough here, but from an adversarial standpoint, is having the client offer up the trust stores and certificate IDs it has going to in
by rezonant 2y ago
I'm far from being versed enough here, but from an adversarial standpoint, is having the client offer up the trust stores and certificate IDs it has going to increase the server's knowledge of aspects of the client we don't want it to know? IE could this contribute to fingerprinting or help to understand the browsing history of the device?
- thadt 2y agoYep. If the client gives up its full list of currently cached intermediate certificates it certainly reveals information about its connection history. Clients would probably need to use per-site certificate caching. But in general your point about fingerprinting is well made. The more negotiation that happens between the client and server, the more data that is available for client fingerprinting and tracking from the server side.