Re: [w3ctag/design-reviews] Cross-spec device identification & association (#64)

Adding some folks for their thoughts: @jyasskin, @zolkis, @reillyeon, @Jan-Ivar, @marcoscaceres, @anssiko, @mounirlamouri

In recent TAG discussion we looked at a variety of topics around device ids, but the one that gathered the most attention was the question of persistence. Our goal is to try and understand the complexities, and then try to establish cross-spec guidance around persistence of device ids (see https://github.com/w3ctag/design-reviews/issues/64#issuecomment-303243097). Two schools of thought have been suggested:

1. Recommend no-persistence by default; to get persistence, the platform will provide an API to convert a temporary device id to a persistent one, optionally with a user-prompt (see suggestion above).
2. Recommend that all device ids be created unique to an origin in a way that the id cannot be guessed by another origin, but can be re-used by the origin in subsequent sessions -- thus persistent. This streamlined approach does not need to involve the user opting-in. Make this the norm for all device ids to enable persistence by default.

In both cases, it would be desirable that clearing the browser settings/storage would clear any persistent ids/cause new unique ids to be used/break the persistence.

Qs:
* Is a user prompt a necessary precaution? Is it overkill?
* What security/privacy benefits are gained by one vs. the other?
* 3rd alternatives?
* Any concerns with my thoughts on correlation-by-default (within an origin--see above)?
* There are risks to making changes to device id on the existing web. Is it worth attempting to change device id behavior at this point?


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/64#issuecomment-305048626