Re: [w3ctag/design-reviews] Probabilistic Reveal Tokens (for IP Protection) (Issue #1125)

etrouton left a comment (w3ctag/design-reviews#1125)

The [goal of IP protection](https://github.com/GoogleChrome/ip-protection#:~:text=limits%20availability%20of%20a%20user%E2%80%99s%20original%20ip%20address) in Chrome’s Incognito mode is to limit the availability of a user’s original IP address, enhancing Incognito's protections against cross-site tracking. A 90% reduction in the availability of IP addresses to proxied domains, one which is freely available across a wide range of devices & platforms, is a large privacy win.

When the IP is revealed, it is indeed linkable to any other use of that IP - that is by design - it is what enables PRTs to most effectively help address fraud and abuse.

However, regarding the point around sites being able to eventually harvest IP address by waiting for a sufficient amount of requests, we think it's strongly mitigated by the fact that PRTs (and IP Protection) are deployed in Incognito mode, where cookies and local storage are partitioned by site and then cleared at the end of each user session. 

As [identified in the explainer](https://github.com/GoogleChrome/ip-protection/blob/main/prt_explainer.md#:~:text=delay%20period%20is%20much%20longer%20than%20typical%20user%20sessions), because the epoch period is much longer than the 95th percentile Incognito session, the probability of IP disclosure to a single site will not increase over time, and other implementations should follow the same precautions.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1125#issuecomment-3200867303
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1125/3200867303@github.com>