> you only tell the subset of third parties between you and the cache. That's not a privacy win at all if you want privacy from the cache, if you don't trust t

> you only tell the subset of third parties between you and the cache. That's not a privacy win at all if you want privacy from the cache, if you don't trust the cache, if the cache is wholly owned or used by you alone. Even if all of that doesn't apply, you don't even have a guarantee that it will hit the cache. If it is a cache miss, no “privacy win”. How many asterisks does this claim of a privacy win need before it should no longer be considered valid? > At a cost of message confidentiality, of course, but if your message content doesn't need to be confidential (i.e. you're just GETing a resource), it's not a big loss. You are forgetting the loss of message integrity, as well. That is a big loss.