4 ms·

My best theory is there is some interested parties (ie Google) that want to use a persistent SPDY/HTTP2 connection host/port as an unavoidable session cookie.

My best theory is there is some interested parties (ie Google) that want to use a persistent SPDY/HTTP2 connection host/port as an unavoidable session cookie. Make your services so that people have to log in and continue the same connection in order to keep using the 'app' and you can track them better. I haven't checked yet but I won't be surprised to find out that Chrome keeps one SPDY/HTTP2 connection open to google-analytics.com that's shared for all domains...

jacquesm 12y ago
Google doesn't need a way to track you using SPDY, they are present on just about every page already, assuming they don't serve it outright and that you didn't navigate there using their search engine.
- bsdetector 12y ago
  That's interesting, because I block analytics and some other Google domains and I use Bing. Why push SSL so hard for sites many of which are just public info anyway? Because then you can't really use proxies so almost always 1 connection is 1 person. The HTTP connection timeout is like 15 seconds or less in popular software. One of the justifications for SPDY/HTTP2 is that with one connection it can be kept open for many minutes or even hours without using too many resources. Instead of many separate, possibly proxied connections to doubleclick you have one connection that lasts maybe even a whole browsing session. Google may not need this, but it's certainly better for them.
  - hrjet 12y ago
    That's an interesting thought. Have created an [issue in our browser](https://github.com/UprootLabs/gngr/issues/54 https://github.com/UprootLabs/gngr/issues/54) to investigate our implementation further.
bsdetector 12y ago
Just confirmed that Chromium reuses the same google-analytics connection for two completely separate web sites and it keeps the socket open for 4 minutes. It almost certainly does the same thing for doubleclick.net. If you spend less than 4 minutes per page then that entire browsing session across all google-analytics pages is uniquely identified to google. Even if you have many people behind a NAT and they have 3rd party cookies disabled, each one's browsing is still a separate clickstream to Google. Only thing making a person's browsing opaque to google is if they browse behind a proxy with a bunch of other people mixed in, and SPDY/HTTP2 conveniently enough make proxies very difficult by needing to trust the proxy's certificate on each client. So anybody needing a proxy will use HTTP1 and anybody using HTTP2 has their browsing sessions uniquely identified.

jacquesm 12y ago

Google doesn't need a way to track you using SPDY, they are present on just about every page already, assuming they don't serve it outright and that you didn't navigate there using their search engine.

bsdetector 12y ago
That's interesting, because I block analytics and some other Google domains and I use Bing. Why push SSL so hard for sites many of which are just public info anyway? Because then you can't really use proxies so almost always 1 connection is 1 person. The HTTP connection timeout is like 15 seconds or less in popular software. One of the justifications for SPDY/HTTP2 is that with one connection it can be kept open for many minutes or even hours without using too many resources. Instead of many separate, possibly proxied connections to doubleclick you have one connection that lasts maybe even a whole browsing session. Google may not need this, but it's certainly better for them.
- hrjet 12y ago
  That's an interesting thought. Have created an [issue in our browser](https://github.com/UprootLabs/gngr/issues/54 https://github.com/UprootLabs/gngr/issues/54) to investigate our implementation further.

bsdetector 12y ago

Just confirmed that Chromium reuses the same google-analytics connection for two completely separate web sites and it keeps the socket open for 4 minutes. It almost certainly does the same thing for doubleclick.net. If you spend less than 4 minutes per page then that entire browsing session across all google-analytics pages is uniquely identified to google. Even if you have many people behind a NAT and they have 3rd party cookies disabled, each one's browsing is still a separate clickstream to Google. Only thing making a person's browsing opaque to google is if they browse behind a proxy with a bunch of other people mixed in, and SPDY/HTTP2 conveniently enough make proxies very difficult by needing to trust the proxy's certificate on each client. So anybody needing a proxy will use HTTP1 and anybody using HTTP2 has their browsing sessions uniquely identified.