Never send user email address in HTTP requests

[Stefan Kangas <stefankangas@gmail.com>]

Eli Zaretskii <eliz@gnu.org> writes:

> It looks like a changeset was installed on master which changes how
> URL behaves in this matter, see commit 346e571230.  I'm worried that
> this is a backward-incompatible change which doesn't seem to have any
> way for users to get back old behavior.  I think we should provide
> such a way, and I think this change should be called out in the
> "Incompatible changes" section of NEWS.

Thanks, I moved it to "Incompatible changes".

The TL;DR here is that I think the issue fixed in 346e571230 is a
serious issue, and that we should not provide a way to get back to the
old behavior.

The other issues we discussed in this thread had to do with
fingerprinting, which is also a real concern.  However, more steps are
required for someone to figure out your real identity.

The basic problem is that a mere misconfiguration of `url-privacy-level'
will lead a user's privacy to be fully compromised.

For example, a typo like:

    (setq url-privacy-level '(eemail))

will make Emacs announce your email (that you customized separately, for
Gnus or Notmuch) to the remote server in every HTTP request.

In fact, it's enough to customize that setting to anything that is not
`high', `paranoid', or a list containing the symbol `email'.

You best not assume you can set it to `medium', or anything like that,
because trying that will be _silently_accepted_ and then: your email
will be revealed.  That's a pretty huge gotcha, and certainly not the
way to design a security feature.

But it gets even worse: url.el used to do these acrobatics to make sure
that there is indeed something privacy breaking in there:

    (or url-personal-mail-address
        user-mail-address
        (format "%s@%s" (user-real-login-name)
                        (system-name)))

AFAIK, no other browser out there provide this misfeature.  It seems
like something from the happy 1990's that has completely outlived any
usefulness, assuming that it was at all useful even to begin with.

Providing a way to get back to the old behaviour is just re-introducing
a bad, bad footgun.  Keeping it around puts users at risk.  So I think
we shouldn't do that.