- From: Kostiainen, Anssi <anssi.kostiainen@intel.com>
- Date: Tue, 2 Feb 2016 14:29:18 +0000
- To: "Lukasz Olejnik (W3C)" <lukasz.w3c@gmail.com>
- CC: "Zhang, Zhiqiang" <zhiqiang.zhang@intel.com>, W3C Device APIs WG <public-device-apis@w3.org>
> On 31 Jan 2016, at 17:34, Lukasz Olejnik (W3C) <lukasz.w3c@gmail.com> wrote: > > It seems that leaving the update frequency to the implementations could somehow allow to fingerprint e.g. the browser and so, possibly, also the user. > In this case, is it necessary to consider it in the security and privacy section? Just guessing (to be challenged or confirmed by Battery Status API implementers lurking on the list) that the update frequency would be the same for every device (perhaps altered for specific device model only in exceptional cases e.g. to workaround bugs?) running the same browser build on the same version of the underlying OS. This would somewhat limit the fingerprintable surface. Say, every device running the latest Chrome Stable on the same Android version would have the same update frequency for Battery Status API *change events. Perhaps good to make a note about this in the spec so implementers can consider it. Lukas - suggestions for text to amend the security and privacy section are welcome :-) Thanks, -Anssi
Received on Tuesday, 2 February 2016 14:29:51 UTC