Re: [csswg-drafts] [css-color] Mitigating fingerprinting for AccentColor/AccentColorText (#10372)

> we don't preserve the system color past the computed value phase (that's a whole thing, see https://github.com/w3c/csswg-drafts/issues/6773). Having to do that just for AccentColor / AccentColorText is rather annoying.

@emilio what do you mean by "preserve" here? Is it the part about flagging that they were system colors? If so, Chromium, in contrast, does follow this resolution as per spec.

I agree, though, that we shouldn't do anything specific for `AccentColor` or `AccentColorText`. Whatever we decide here should likely be extended to all system colors that we expose.

> What mechanism do you plan to use for this exactly?

> > Good question. I suppose that if we start passing colors around as unresolved values in certain places, then maybe canvases can check for these values...?

In Chromium, we do store a bit that notes if a color was a system color, so we could use the same mechanism here to tell what cases it would be needed. Chromium also has a [fallback set of colors we use for system colors](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/layout/layout_theme.cc;l=559) that are not tied to any OS that we could consider falling back to in cases where needed.

However, I am not familiar with the fingerprinting risk of using these in canvas and interpolation. @josepharhar would you be able to provide more details on that?

> Prevent getComputedStyle() from returning the actual system accent color. Should it return a fixed color or something else?

I do think this could be an option. As mentioned above, perhaps we could set a fallback color for the different system colors and use those in this case.

-- 
GitHub Notification of comment by alisonmaher
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/10372#issuecomment-2140804830 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Thursday, 30 May 2024 20:22:16 UTC