[afnog] privacy vs caching

[Phil Regnauld]

Amreesh Phokeer (amreesh.phokeer) writes:
> 
> User experience set aside, one question that I think is worth asking is why
> should we cache information which needs to be encrypted in a first place,
> knowing there is a potential security issue there?

	There's a difference between encrypting end-to-end and transport
	encryption. If you really need the information to be protected
	(auth, confidentiality, integrity), then SSL isn't the answer.

> By default, my Firefox browser sets SSL disk caching config to true.
> browser.cache.disk_cache_ssl;true

	It should be set to false, if you're really worried. True means
	sensitive data is being cached on your machine.

	Cheers,
	Phil