Re: [w3ctag/design-reviews] EditContext API (#416)

My definition of sensitive data would be any information conveyed by the user to the site that the user didn't explicitly intend to provide.  

In the case of EditContext, which deals with delivering text that has been input by the user to the active document, I expect that the user's intent is to provide the site with the text that has been typed on a keyboard, or composed in an IME, or spoken to an OS speech to text input mechanism, etc.  EditContext doesn't expose any of the details of how the text was provided directly, only the resulting text and some direction as to how the text should be decorated during the process of composition.

The text data input by the user is already available through alternative means, e.g. the beforeinput event; the EditContext is just providing it in an alternate way that is decoupled from the DOM.  The decoration information seen in the IDL as part of the TextFormatUpdateEvent is new, but we don't consider it sensitive.  

If there is a threat to be considered for formatting information, it would be that an author may differentiate one input method from another based on the conventions that the input method has adopted for formatting its text during composition.  For example, speech input may use a dotted gray underline while a Japanese IME would use a solid black underline.  This formatting data is necessary for sites like Google Docs and Office Online to meet user expectations during text input, and we believe its acceptable to expose this information to web sites so that the user can input text in a way that is consistent with their experience.

Note that there are other mechanisms already that may reveal similar information about the user.  One example are the heuristics by IMEs to suggest candidates for some phonetic input that are most frequently selected by the user.  The first candidate after typing the phonetic input will be inserted into the DOM and visible to the author's script.  While this may provide some new bit of information to fuel fingerprinting, it allows the user to have a fast and consistent input experience, which IMO outweighs the minor privacy concern.

I hope this helps.  If this is the information you're looking for we're happy to include it in the explainer.  If you need more or disagree with any of the points we've raised please let us know.

Thanks!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/416#issuecomment-591024638