search

WICG / direct-sockets

Direct Sockets API for the web platform
Other
362 stars 14 forks source link

Proposed privacy mitigation- raises privacy concerns. #12

Closed LiEnby closed 4 years ago

LiEnby commented 4 years ago

If the API is denied in private browsing modes, then you can easily detect if a user is in a private browser mode by simply attempting a connection, if its denied then you know the user is in some private mode,

this could be used as a way to track users using private modes, or potentially as a way of 'browser fingerprinting'

ewilligers commented 4 years ago

  1. A web app can't silently attempt a connection - the user will see a dialog requesting consent. If the user declines consent, or if the user agent denies permission for other reasons, the web app simply observes a promise rejection.

  2. PR https://github.com/WICG/raw-sockets/pull/8 allows use in private browser mode.