search

WICG / attribution-reporting-api

Attribution Reporting API
https://wicg.github.io/attribution-reporting-api/
Other
353 stars 167 forks source link

Query keys aggregate in the aggregation service #470

Open alois-bissuel opened 2 years ago

alois-bissuel commented 2 years ago

Hello,

One interesting evolution of the aggregation service would be to enable querying aggregate of keys. I think this was mentioned in the aggregate attribution API at a time when the aggregation was supposed to be performed by MPC rather than TEEs. In other words, I would love to be able to query a bit mask (eg for a 8 bit key, 01100*01 would be 01100101 and 01100001). This would enable a greater flexibility for decoding (ie chosing which encoded variables to get depending on the number of reports), and negate the need to adapt the encoding depending on the expected traffic to the destination website. Thanks!

P.S. Cross-posted from the trusted execution aggregation service

csharrison commented 2 years ago

Thanks @alois-bissuel! This seems like a useful functionality to add. I don't see a privacy cost to this feature request, and it seems like it does indeed boost ergonomics quite a bit.

It seems like the masking functionality you described only enables the querying of some aggregation of keys. I wonder if it is worthwhile to think through alternative query mechanisms that would allow querying a group like:

This would probably entail extending the API to support lists of buckets, potentially with some ergonomic enhancement with masking as you mentioned.

cc @palenica

palenica commented 2 years ago

Thank you Charlie for responding, and thank you Alois for the question.

Agree that a feature like this seems like a win in usability and utility, with no apparent downside in privacy. We should flesh out the proposal a bit (e.g. I like Charlie's proposal of a list of buckets potentially combined with masking), and reach a consensus that this is a feature worth supporting.

The implementation work seems relatively modest to me. That said, at this point our team's plate is quite full with things like production hardening, adding test coverage and open sourcing. Please allow some time before we're ready to start considering feature requests.