search

mozilla / standards-positions

https://mozilla.github.io/standards-positions/
Mozilla Public License 2.0
650 stars 72 forks source link

Positions on the standards Webkit considers to be vulnerable to fingerprinting #378

Closed voxpelli closed 4 years ago

voxpelli commented 4 years ago

The WebKit team recently published a list of standards which they refrain from implementing in their current state due to fingerprinting concerns.

Of those at least 5 already have public positions from you:

* Network Information #117 * Web USB #100 * Web NFC #238 * Web Bluetooth #95 * Serial API #336

But the rest are missing such as far as I can see:

* Web MIDI API #58 * Magnetometer API * Device Memory API * Battery Status API * Web Bluetooth Scanning * Ambient Light Sensor * HDCP Policy Check extension for EME #243 * Proximity Sensor * WebHID * Geolocation Sensor (background geolocation) #36 * User Idle Detection

As this blog post has caused some discussion on eg. Twitter, it would be interesting to know more about your position on more of those that the WebKit team are skeptical towards. Maybe you agree with them and find all of them harmful or maybe there are some which you actually think differently about.

Sorry if this is a much too wide request. I think it's better to open this and have it closed by you and then to know that you think it's a too wide question than not to ask. I hope that is okay with you 🙏

saulamsal commented 4 years ago

Would love to know if Mozilla has any consideration regarding Network Information. Serving different resources based on network information and adjusting the content will greatly benefit PWAs.

dbaron commented 4 years ago

So I think having a single issue for multiple requests for positions will quickly become impractical: too difficult to follow and track. So I think we should stick to our general policy of having one issue per specification on which a position is requested.

I've edited your initial comment to link to the existing issues on these specifications -- some of the "missing" ones have open issues, some with a good bit of discussion so far -- although a number also don't have issues that I could find.

(I think there are also some of those where we've publicly stated positions prior to the existence of this repository but never documented here, and also some of those that we haven't really analyzed yet.)