0008707: /keys (and /terms) headers enable tracking of wallets

ID	Project	Category	View Status	Date Submitted	Last Update
0008707	Taler	exchange	public	2024-04-07 09:11	2024-04-15 19:32

Reporter	Christian Grothoff	Assigned To	Christian Grothoff	Resolution deadline
Implementer		Reviewer
Release signed by		Deployed by
Verifier		Communicator
Data protection authority notification required	No
CSIRT notification required	No
Estimated effort (hours)		Actual effort (hours)	0
Fast-track	No
Work package	none
Priority	high	Severity	major	Reproducibility	always
Status	closed	Resolution	fixed
Platform	i7	OS	Debian GNU/Linux	OS Version	squeeze
Product Version	git (master)
Target Version	0.10	Fixed in Version	0.10

Summary	0008707: /keys (and /terms) headers enable tracking of wallets
Description	Right now, both include an "Expires" header with seconds precision, which in-effect would allow a server to track a wallet as it is a proxy unique identifier. We should round the times. Also, the "Last-modified" header is incorrectly set to the current time even if there was no modification.
Tags	No tags attached.

Date Modified	Username	Field	Change
2024-04-07 09:11	Christian Grothoff	New Issue
2024-04-07 09:11	Christian Grothoff	Status	new => assigned
2024-04-07 09:11	Christian Grothoff	Assigned To	=> Christian Grothoff
2024-04-08 18:30	Christian Grothoff	Status	assigned => informing
2024-04-08 18:30	Christian Grothoff	Resolution	open => fixed
2024-04-08 18:30	Christian Grothoff	Fixed in Version	=> 0.10
2024-04-08 18:30	Christian Grothoff	Note Added: 0022160
2024-04-08 18:31	Christian Grothoff	Target Version	0.11 => 0.10
2024-04-15 19:32	Christian Grothoff	Status	informing => closed

Christian Grothoff 2024-04-08 18:30 manager ~0022160	The last-modified header is actually the one that would have made tracking clients easy. Wallets should watch out for that one. The current exchange no longer sets it and ONLY uses the etag.