Re: [w3c/manifest] Rewrite privacy considerations on fingerprinting in start_url (PR #1114)

@mgiuca commented on this pull request.



> @@ -816,18 +817,29 @@ <h3>
             This can be useful for analytics and possibly other customizations.
             However, it is also conceivable that developers could encode
             strings into the start_url that uniquely identify the user (e.g., a
-            server assigned <abbr>UUID</abbr>). This is fingerprinting/privacy
-            sensitive information that the user might not be aware of.
+            server-assigned <abbr>UUID</abbr> such as `"?user=123"`,
+            `"/user/123/"`, or `"https://user123.foo.bar"`). This is
+            fingerprinting/privacy sensitive information that the user might
+            not be aware of.
+          </p>
+          <p class="note">
+            It would be irresponsible for a developer to use the [=start URL=]
+            to include information that uniquely identifies a user, as it would
+            represent a fingerprint that is not cleared when the user clears
+            site data. However, nothing in this specification can practically
+            prevent developers from doing this.

Hmm.... I can't exactly point to the bit that says that you can't do this, but it would be weird I think if user agents do this. (i.e. it would break sites - you can't just randomly delete any single character from a URL because you don't know if it's important.)

The top of this spec says "The start_url member is purely advisory" so I guess UAs can do whatever they want. But I think there is an expectation that UAs actually load up the app at the URL developers specify and they shouldn't be changing it. (I would perhaps suggest we remove the statement "The start_url member is purely advisory".)

So while this may technically be true, I wouldn't say it like this as if it's a good idea for UAs to do.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/1114#discussion_r1585930830
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/manifest/pull/1114/review/2033101022@github.com>