Stealing may be the wrong word, but I actually think this is important. I don't think the providers have been up-front about how we should be handling these thought signatures. A large system with a lot of users may be capturing these and even caching them to send them back with future requests. If data can be pulled out of these, then they need to be treated more like cookies than opaque, encrypted nonces.
reply