Re: [w3ctag/design-reviews] Trust Token API (#414)

We're doing some work in the Privacy Pass IETF working group to try to more explicitly handle some of these issues (being more explicit about the boundaries/contexts operations are being done in, trying to pull in and articulate the centralization concerns to try mitigating them in the solutions/protocol changes).

Generally I agree, that I think the API will need to have more explicit mitigations/safeguards in the use of issuance/redemption in different contexts/origins/etc to protect against cross-site tracking/fingerprinting, rather than being reliant on having an understanding about the sort of information being embedded.

I can write up a doc gathering safeguards and boundaries included to try mitigating some of the cross-site tracking concerns to get a review over that model/framework and related concerns that have come up from the Privacy Pass side.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/414#issuecomment-840659572