- From: Martin Thomson via GitHub <sysbot+gh@w3.org>
- Date: Wed, 18 May 2022 23:44:50 +0000
- To: public-patcg@w3.org
A secure connection to an origin doesn't naturally mean that actions can be attributed to that origin. In the case where events are generated by script, there is generally only one relevant origin, which is the document origin. Even if the script originated on a different origin - using HTTPS, of course - it's the origin of the page (or frame) that matters. It is precisely this setting - where third parties are entrusted with the ability to execute code in the page origin - that is most challenging here. If we assume that sites don't change - either to apply any policy controls we might build, or to change how third party content is isolated - then third-party content will be executed in their origin and we'll lose any provenance information. -- GitHub Notification of comment by martinthomson Please view or discuss this issue at https://github.com/patcg/private-measurement/issues/14#issuecomment-1130754566 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Wednesday, 18 May 2022 23:44:52 UTC