[csswg-drafts] [css-color] Mitigating fingerprinting for AccentColor/AccentColorText (#10372)

josepharhar has just created a new issue for https://github.com/w3c/csswg-drafts:

== [css-color] Mitigating fingerprinting for AccentColor/AccentColorText ==
AccentColor/AccentColorText were created here: https://github.com/w3c/csswg-drafts/issues/7347

We still haven't shipped this in chromium due to fingerprinting concerns, but I have gotten a lot of interest about providing access to the system accent color so I'd really like to ship it. WebKit has also avoided shipping this by returning a static color instead of the actual system accent color, and I'd hope that if we do mitigations then they will start using the system accent color as well: https://github.com/WebKit/standards-positions/issues/136

I think proving that the system accent color is not significantly fingerprintable would be difficult or impossible, especially since there are many different platforms which we want to ship this on.

@emilio [said](https://github.com/w3c/csswg-drafts/issues/7347#issuecomment-1698137702) that we shouldn't allow this color to resolve to something other than a color since we don't do that for anything else, but in the interest of shipping this in chromium I think that we should.

Some limitations to consider:
- Prevent AccentColor/AccentColorText from being used to draw to a canvas.
- Prevent getComputedStyle() from returning the actual system accent color. Should it return a fixed color or something else?
- [Prevent interpolation](https://github.com/w3c/csswg-drafts/issues/7347#issuecomment-1690563820) when AccentColor/AccentColorText is used.

Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/10372 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Tuesday, 28 May 2024 21:26:49 UTC