privacycg / nav-tracking-mitigations

Navigation-based Tracking Mitigations
https://privacycg.github.io/nav-tracking-mitigations/
35 stars 15 forks source link

Make cross-site condition more explicit #15

Open martinthomson opened 2 years ago

martinthomson commented 2 years ago

The document isn't especially crisp in how it treats same-site and cross-site navigations differently.

There are a few ways in which this lack of clarity manifests. The login example of https://example.com/login?returnto=item/12345 is one. This strongly implies that the link origin and return destination is https://example.com/item/12345. If we don't care about tracking across same-site navigations that might be OK on the basis that the information is kept within the same site.

However, the lead-in to that example might be read to imply that we are only interested in the cross-site scenario. That means that the "item/12345" refers to something else, either drawing from Referer or something implicit. If the link was followed from another site (https://other.example/item/12345 say) then we might have navigation tracking. We might also have navigation tracking on the return link, but that's probably separable and covered by other examples.

johannhof commented 2 years ago

I suggested adding this example but in hindsight you're right that this specific case would always happen in a same-site scenario. We can remove it, but then I agree the spec should clarify whether "link decoration" by definition is only observed on cross-site navigations.

(In my opinion it should, since in a same-site scenario there are other ways of transferring/storing this information, such as in a cookie).