Re: Canvas fingerprinting

Jumping in to this discussion …

As a reminder, PING is working on fingerprinting guidance for Web specification authors. Thanks to Nick for leading this.

[Abstract: Exposure of settings and characteristics of browsers can impact user privacy by allowing for browser fingerprinting. This document defines different types of fingerprinting, considers distinct levels of mitigation for the related privacy risks and provides guidance for Web specification authors on how to balance these concerns when designing new Web features.]

The current (unofficial) draft is available here: https://w3c.github.io/fingerprinting-guidance/

It would be useful here to have a robust discussion about what can and should be done (if anything) with respect to canvas fingerprinting.

In any case, we would really like some more reviews and feedback on the draft.

Christine

On 22 Jul 2014, at 9:24 am, Rigo Wenning <rigo@w3.org> wrote:

> On Monday 21 July 2014 15:46:35 David Singer wrote:
>> I don’t disagree with needing a meaningful DNT, but I also think we
>> need to think of other ways we can assist/improve online privacy,
>> that are not DNT.
> 
> What about not exposing your local fonts and using WOFF instead? For the 
> moment, for security and for privacy, same origin means a fully trusted 
> relation. (You remember that I think of the distinction between 
> first/third party in DNT as the biggest mistake since sliced bread)
> 
> There is far too little thinking about rogue servers that access the 
> browser within the same origin. The only thinking is about gaining 
> access to the client machine. But this is better done with phishing 
> email or some such worm. The hacking of the client side from the server 
> side is rather to get information without being transparent about it. In 
> the name of security, reliability, debugging, delivery etc all available 
> info is stored and then re-used for something else =>big data. 
> 
> I think the necessity and relation to functionality of browser 
> information exposure  could be a good topic for research before going 
> Working Group and production. But it would need the willingness of 
> browser makers to participate in that research. Because in the past, I 
> haven't seen much good cooperation between privacy researchers on one 
> side and browser developers on the other side. The climate is better now 
> than it was in the past. 
> 
> --Rigo
>

Received on Wednesday, 23 July 2014 13:58:42 UTC