Re: [w3ctag/design-reviews] Migrating some high-entropy HTTP request headers to Client Hints. (#320)

Hey Mike!

At today's Tokyo F2F, we had a great discussion about this proposal. We didn't dive too deeply into the technical proposal, but discussed the problem space at a high-level. As you might have expected, the TAG is supportive of efforts to reduce fingerprinting, especially passive fingerprinting which we think has a much smaller surface area that we can affect in the browser. Given this framing, we are actually quite happy to see this effort around the User Agent string (and Accept header) move forward. We believe it will be great to have the User Agent string (that is sent by default) ultimately have less-entropy by transitioning the entropy into opt-in client hints.

We liked the fact that, as client hints, the client can be aware of which servers are asking for the extra entropy, and potential for fingerprinting that go with it.

So... this is the official "thumbs-up" from the TAG. Please continue developing this proposal, and we look forward to being involved in future review requests!

The is TAG, signing off.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/320#issuecomment-460926256

Received on Wednesday, 6 February 2019 07:30:06 UTC