Header enrichment?

[martinthomson]

"header enrichment" is a marketing euphemism for an attack on the security of the HTTP protocol. In other contexts this is known by the (now out of favour) "man in the middle attack" or just "modification attack".

Generally speaking, this sort of practice is no longer possible, except in cases we consider to be known bugs in the system¹.

See #276 for another example of a concept that is introduced and then left unused.

Footnotes

1. That is, the ongoing use of cleartext HTTP and the "http:" URI scheme is the bug, as opposed to HTTP over TLS and "https". ↩

[npdoty]

This is referring to a more specific threat to user privacy that is enabled through a modification attack; modification can be used for many security and privacy attacks. If there's an alternative, non-marketing term for network attackers introducing identifiers into traffic so that endpoints can identify the user, that would be welcome. My understanding is that researchers who have written about the attack also use the "header enrichment" phrasing, perhaps because the predominant use has been by industries that adopted the terminology.

[darobin]

Fixed by #340