Tracking vector tracking

[annevk]

I'm not sure where exactly we'd want to put this. Thoughts?

[foolip]

Just towards the end, where privacy considerations usually go in specs?

[annevk]

As a top-level section?

[foolip]

Maybe, "Security and Privacy Considerations"?

[xfq]

Do you mean defining something like this:

Certain characteristics of a user's system can be used to distinguish
groups of users from each other; by collecting enough such
information, an individual user's browser's "digital fingerprint" can
be computed, which can be as good, if not better, as an IP address in
ascertaining which requests are from the same user.

Features that can be <dfn>used to fingerprint the user</dfn> are
marked as this paragraph is. <a class="fingerprint"
href="#fingerprinting-vector"><img src="images/fingerprint.png"
alt="(This is a fingerprinting vector.)" /></a>

Then dependent specifications use <a class="fingerprint" href="https://infra.spec.whatwg.org/#fingerprinting-vector"><img src="https://infra.spec.whatwg.org/images/fingerprint.png" alt="(This is a fingerprinting vector.)" /></a> to assert that this feature may add fingerprinting surface area?

---

Maybe it can be a feature of Bikeshed/ReSpec...

[annevk]

@xfq yeah, that seems about right, and yeah, I think we'd want some syntax in Bikeshed if we actually want references to include the image. And since including the image makes the privacy situations more discoverable that seems like a good thing as well.

@tabatkins?

[tabatkins]

Seems reasonable, tho including an image is a little iffy - it won't show offline, W3C publishing standards don't allow outside images to be linked, etc.

Any chance I can get the fingerprint as an SVG? With that, I could include it directly in the document when needed, and <use> it if it's in more than one place. Worst case, I can use a data:url in an SVG to the same effect.

[annevk]

Good idea, filed whatwg/resources.whatwg.org#49.

[domenic]

I think ideally for WHATWG specs at least we'd want to use an <img> tag for it so that it gets cached and reused across all specs. Could that be configurable, so that WHATWG could do "Fingerprint URL: ...." in our spec config?

[zcorpan]

whatwg/resources.whatwg.org#50 is 581 bytes, which seems small enough to use inline? Though without img it needs something for accessibility... I guess role="img" aria-label="(This is a fingerprinting vector.)"

[tabatkins]

Could that be configurable, so that WHATWG could do "Fingerprint URL: ...." in our spec config?

Certainly.

it needs something for accessibility...

Yeah, seems like what you wrote is best-practice for labelling.

[zcorpan]

I used the text suggested by @xfq above (thanks!) in #115.

HTML has more text: https://html.spec.whatwg.org/#fingerprint

What do we want to move over all of it to Infra?

[annevk]

I guess I'm in favor of moving most of that text over to Infra, since it's a rather broad description of the problem that should help folks realize when they need the annotation. (And it means we get to remove it from HTML, which will then become a bit smaller.)

[annevk]

Current status:

• This is generalized to tracking vectors, which include fingerprinting. The text can be reviewed in Define fingerprinting vector #115. It has had some review from @othermaciej already.
• Icon and style sheet rules are added in Add a tracking vector image whatwg.org#64.
• HTML Standard build infrastructure update is at Update URL to fingerprint image wattsi#41.
• HTML Standard text update is at Use Infra as infrastructure for tracking/fingerprinting marking html#4933.
• Bikeshed update is discussed at Add fingerprinting watermark when requested speced/bikeshed#964 and hopefully @tabatkins will get to it this week. Apart from reviews this is the main blocker, but please do start reviewing now if you're interested in this.

It might get a little messy as all of these PRs have interdependencies.

[annevk]

Update:

• Define fingerprinting vector #115 is considered done.
• Icon and style sheet rules are merged.
• HTML Standard changes are still good.
• I've submitted two PRs to Bikeshed to make the WHATWG templates use the new feature and refine the feature a bit. They still need review and be landed.

Once the Bikeshed changes land we can land #115 and once that lands we can land the HTML Standard changes and update BIkeshed to always link to Infra when this feature is used.

Everyone else can start using it after that.