search

WICG / attribution-reporting-api

Attribution Reporting API
https://wicg.github.io/attribution-reporting-api/
Other
360 stars 171 forks source link

Per-reporting-site privacy budgeting #661

Closed csharrison closed 1 year ago

csharrison commented 1 year ago

I want to consider moving privacy budgeting in ARA to be per-site (eTLD+1), rather than a mix of per-site and per-origin budgeting. There are a few reasons to do this:

The relevant limits in the spec that consider origins are:

  1. Max destinations covered by unexpired sources: x unique destinations per (source site, reporting origin)
  2. Max attributions per rate-limit window: x attributions per (source site, attribution destination, reporting origin, time window)
  3. Max attribution reporting endpoints per rate-limit window: x reporting origins per (source site, attribution destination, time window) counted per attribution
  4. Max source reporting endpoints per rate-limit window: x reporting origins per (source site, attribution destination, time window) counted per source registration

If we just modify all origins to be sites, (1) and (2) are tightened and (3) and (4) are loosened. For this reason, I propose we keep (3) and (4) per-origin to avoid regressing privacy. Note that this change may have a negative utility impact, for cases where a given publisher / advertiser pair is using many reporting origins which share a site. In my mind, this isn’t a legitimate use-case to achieve more privacy budget, though we're certainly open to feedback if this change puts at risk legitimate use-cases.

cc @arturjanc

bmayd commented 1 year ago

Can you clarify what you mean when you refer to "site"?

csharrison commented 1 year ago

Updated the comment, I am referring to a site as an eTLD+1 matching this spec definition: https://html.spec.whatwg.org/multipage/browsers.html#site

TATERNATRR commented 4 months ago

Hey everyone look I'm new to this I was invited in a comment to come here I promise I'm not trying to make no excuses I know this is a flag on me cause I tried to mix some some things to build a bot straight up I wanted to try something an blow a build I never had intentions on starting so I can't blow another one I can't explain it to yall I got stretched out an it locked everything up so fast I couldn't come back but I'll take any ass chewing I'm owed an if yall can break this down to me I do learn fast I just had to much going on to long an I never did the full blown development before an had no help but I don't know know what's all going on I did know that this browser was already about to start bad that fast I never did anything but look at it so if yall would please help me get out this bad stop I would REALLY APPRECIATE IT