Re: [w3ctag/design-reviews] Fenced frames with local unpartitioned data access (Issue #975)

As I understand it, something happens when someone clicks on the frame.  So there is a difference between an outcome where someone clicks and when someone doesn't.  The embedding contexts learns about whether there was a click.

If the content shown can affect whether a click occurs, then the embedding context gains information.  In the extreme, you might imagine content in the frame that guarantees a click in one case ("click here to enable this free addon") and guarantees no click in another (leaving the area blank or "click here to agree to something awful"), then the information carried by that click (or absence thereof) is high.  Maybe it's not perfect, because people are often perverse like that, but you have created a means of exfiltration.

https://github.com/WICG/turtledove/issues/990 goes into more detail about the sorts of things you might do to gain information from the human involved.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/975#issuecomment-2504810702
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/975/2504810702@github.com>