Re: [w3c/manifest] Privacy Review: handle start_url tracking (#399)

Just caught up on this: I don't think it's feasible to do any manipulation of the query for the `start_url`. It is completely legitimate for the content of the page to be based on the query, and reasonable (though inadvisable) for the "home screen" of an app to be at a particular query, where deleting the query string takes you to a different page.

In fact we are having a parallel discussion about [extending service worker and manifest scope to allow query parameter matching](https://github.com/wanderview/service-worker-scope-pattern-matching/blob/master/explainer.md), because some websites actually distinguish different "apps" based on the query string. If at some point in the future, the manifest `scope` will be distinguishable by query parameter, it will be necessary for `start_url` to not ignore the query string (since [`start_url` must be within scope of `scope`](https://www.w3.org/TR/appmanifest/#scope-member)).

From a privacy standpoint, there is no advantage to removing the query string, since tracking information can easily be encoded in the path. It is inherent in giving sites the ability to (at the user's choice) save a URL on the user's machine that they can re-open later, that they can encode user-identifying information in the URL.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/399#issuecomment-531636391