I wonder what percentage of http traffic is redundant compression dictionaries. How much could this actually help in theory?
A lot of times you will send a (possibly large) blob of text repeatedly with a few minor changes.
One example I've used in practice is session descriptions (SDP) for WebRTC. Any time you add/remove/change a stream, you have to renegotiate the session, and this is done by passing an SDP blob that describes all of the streams in a session in and out of the Javascript Session Establishment Protocol (JSEP) API on both sides of the connection. A video conference with dozens of participants each with separate audio and video streams joining one at a time might require exchanging hundreds or even thousands of SDP messages, and in large sessions these can grow to be hundreds of kB each, even though only a tiny portion of the SDP changes each time.
Now, you could do a lot of work to parse the SDP locally, figure out exactly what changed, send just that difference to the other side, and have it be smart enough to patch its local idea of the current SDP with that difference to feed into JSEP, test it on every possible browser, make it robust to future changes in the SDP the browser will generate, etc.
OR
You could just send each SDP message compressed using the last SDP you sent as the initial dictionary. It will compress really well. Even using gzip with the first ~31 kB of the previous SDP will get you in the neighborhood of 200:1 compression[0]. Now your several-hundred kB SDP fits in a single MTU.
I'm sure WebRTC is not the only place you will encounter this kind of pattern.
[0] Not that either gzip or using part of a document as a dictionary are supported by this draft.
I work with WebRTC outside a browser context, and we signal calls with simpler datastructures and generate the SDP right near the WebRTC Api. Our SFU doesn't ever see an SDP, because SDP is a big messy format around simpler parts --- it's easier to just communicate the simpler parts, and marshal into SDP at the API border. Even for 1:1 calls, we signal the parts, and then both ends generate the SDP to feed to WebRTC.
IMHO, you're going to have to test your generated SDPs everywhere anyway, regardless of if clients or servers generate them.
Well managed compression would certainly help reduce SDP size in transit, but reduce, reuse, recompress in that order.
There's a huge difference between "this could potentially be used to fingerprint a client" and "this will primarily be used to fingerprint a client".
There are many potential fingerprinting mechanisms that rely on tracking what the client already has in its cache. Clients could easily partition their cached dictionaries by origin, just as they could partition other cached information by origin, and that would prevent using this for cross-origin tracking.
This proposal would help substantially with smaller requests, where a custom dictionary would provide better compression but not better enough to offset the full size of the dictionary.
As the when this is useful there are many examples:
* Map tiling (like OSM, mapbox, google maps, etc.) often have many repeated tokens/data but the tiles are served as individual requests
* Code splitting of CSS/JS, where they share a lot of the same tokens but you don't want to have to load the full bundle on every load since much of it wont be used
* Any site where the same terms and/or parts are recurring across multiple pages (for many sites like IMDB or similar I'd guess 80% of the HTML is non-unique per request)
This has been tried before with SDCH which unfortunately died, hopefully this goes better.
It also solves the problem that SDCH had where the dictionary would be forced on the response and the client would have to go fetch it if it didn't have it before it could process the response.
The tooling for generating dictionaries is also WAY better than it was back in the SDCH days (and they are a much cleaner format, being arbitrary byte strings that Brotli and ZStandard can back-reference).
Lots of people involved in working on it were also involved with SDCH and have been trying to find a workable solution since it had to be turned down.
The cache is partitioned by document and resource origins, so you might as well just use first party cookies at that point (or etags if you insist on being sneaky).
This doesn't really add any fingerprinting that doesnt already exist.
10. Privacy Considerations
Since dictionaries are advertised in future requests using the hash
of the content of the dictionary, it is possible to abuse the
dictionary to turn it into a tracking cookie.There are LOTS of privacy teams within the respective companies, W3C and IETF that have looked it over to make sure that it does not open any new abuse vectors. It's worth noting that Google, Mozilla and Apple are all supportive of the spec and have all been involved over the last year.
For browsers specifically, the fetch spec changes will be explicit about the cache clearing and partitioning (partitioned by both top-level document site and frame origin). You can see Chrome's implementation here: https://source.chromium.org/chromium/chromium/src/+/main:net...
The fetch spec changes are in progress (just documenting, the discussions have already happened). You can follow along here if you'd like: https://github.com/whatwg/fetch/issues/1739