Re: exposing underlining mechanism for IME?

On Fri, Nov 06, 2015 at 07:40:03PM +0100, Johannes Wilm wrote:
> thickness, color and backgroundColor are the values used in the browser
> code for markers. I didn't see foreground color. So unless there is some
> other code somewhere else that I haven't seen, those three properties seem
> to cover everything browsers need to do for IME marking as of November
> 2015. :)

My thinking is, "Is this 'marker' some new DOM entity?" and "Who knows
what marker properties tomorrow will bring."

> On Fri, Nov 6, 2015 at 7:18 PM, David Young <dyoung@pobox.com> wrote:
> > What if, instead, there was an API
> > function that returned the CSS property-value pairs for a composition
> > candidate---getCompositionStyle()?  The the editor could apply the
> > style, modify it, or ignore it, according to the author's preference.
> 
> Well, first of all it is really hard for us to underline part of a text
> node using only CSS.

Seems like an editor can enclose the range in a <span> styled
'text-decoration: underline'?

> Secondly, we often run into security issues.

I think the problem you're concerned about is browser fingerprinting?
Couldn't you also use timing of addCompositionMarker() to fingerprint?
Can't you render HTML to a Canvas, serialize the Canvas, and look
for the signature of an IME marker in it?  I suspect that there's an
infinite regress of issues here, and we're going to be stuck if we have
to quiet every security concern before we've built a single satisfactory
editor.

Thinking more about privacy in this context: won't the editor content
itself going to be *quite* revealing about the user/browser identity?

Furthermore, even from the timing between editing events, you could
probably tell a great deal about a user.  Why, some of us have keyboard
"tics" (think "head scratching" or "beard stroking," only your hands
are idling fiddling with the keyboard/cursor/editor) that would
quickly identify us, even if timing information was unavailable to
JavaScript.  (Is there any way for the paranoid to withhold a timebase
from JavaScript?)

Dave

-- 
David Young
dyoung@pobox.com    Urbana, IL    (217) 721-9981

Received on Saturday, 7 November 2015 18:43:34 UTC