Re: [w3c/payment-handler] Open Window Algorithm and tracking through 1ps (#351)

> I feel I'm missing some key insight to understand why segmented storage helps here. Would you help me understand?

Segmented storage prevents this kind of tracking because when ewallet.com is a 3p of store1.com, it gets a separate cookie jar (and other storage) than when ewallet.com is a 3p of store2.com.  The distinct cookie jars (sometimes called double-key-ing storage, since `(store1.com, ewallet.com)` gets distinct storage from `(store1.com, ewallet.com)`) prevents ewallet from connecting the two sessions.y b

> I agree theoretically you could do this. However, I suspect the fact that the tracking is not completely seamless (because a modal will open) would make this not a very useful mechanism to deploy trackers

Unfortunately, the web platform is full of privacy harms that start exactly this way "sure its possible, but no way anyone would ever use it".  Partial list includes etags, HSTS cookies, communicating across tabs using nested iframes, 1000 different sources of fingerprinting entropy, etc etc etc etc.  If there is a way to track, you can be sure someone, somewhere will use it

> Removing referrer header seems a reasonable proposal. How would removing query parameters work? Would I no longer be able to link to a page with query parameters?

This differs by browsers (Safari strips all query params when the user is coming from a labeled tracking domain, Brave ships a set of query params used by known trackers, etc), but is getting increased focus.  There is no perfect solution right now, but things are in a "lets not make the problem worse while we try to solve it" scenario.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-handler/issues/351#issuecomment-552139431