Improvements to the fingerprinting PR #1133
Conversation
|
|
||
| Other devices and user agents will <dfn>usually support</dfn> sessions of a given {{XRSessionMode}}. <span class='note'>For example: User agents that run exclusively within VR headsets are likely to support {{XRSessionMode/"immersive-vr"}} sessions unless specifically blocked by the user.</span> In these cases reporting that the {{XRSessionMode}} is not supported, while accurate, would offer more uniquely identifying information about the user. As such reporting that the {{XRSessionMode}} is always available and allowing {{XRSystem/requestSession()}} to fail is more privacy-preserving while likely not being a source of confusion for the user. | ||
| User agents [=indistinguishable by user-agent string=] for which availability of XR capabilities is highly variable, such as desktop systems which support XR peripherals, present the highest fingerprinting risk. User agents on such devices MUST NOT allow the {{isSessionSupported()}} API to provide additional fingerprinting bits without there being [=explicit consent=] from the user to do so. This MAY involve one of the following techniques: |
There was a problem hiding this comment.
I would like this to indicate that either explicit consent or implicit consent is required. (In other words, I do not want to require that PWAs to have to nag me on launch.)
There was a problem hiding this comment.
So I think the explicit vs implicit distinction can be confusing: My read of the current spec text is that implicit consent includes things like "you visit this website a lot". I did edit the text of explicit consent to say that installed web applications can be considered to be explicit consent provided consent was requested at install time. Does that seem okay? We can also tweak the whole thing to focus on consent.
There was a problem hiding this comment.
Reading through it again, I think it's OK. This is definitely an improvement over the text in my PR and I suspect it'll need a bit more iteration before it properly lands, so, let's just merge it.
Some improvements to #1124
This is based on #1124 and is intended to be merged onto that branch
Preview | Diff