Closed jyasskin closed 3 years ago
Just noting that all of the above comments except for the second to last (related to audio
and image
elements and the @condition
attribute) pertain to TTML1 and TTML2 in general, and that the remaining comment pertains to TTML2 in general. Though not necessarily addressed individually, many of these comments are covered indirectly by the remarks found in TTML2 First Edition Appendix P Security and Privacy Considerations.
Thanks for that @skynavga - I took an action to respond during last week's call, but I think you've said what I was going say, near enough.
In that case, the only question that remains is how to label this issue and what (if any milestone to associate it with). Could you consider the possible WR-* labels and choose one as well as a milestone?
I think we are saying we will consider an informative change to Appendix P to call out audio
and image
in conjunction with @condition
at some point, possibly in Proposed Rec or in a later edition.
That sounds reasonable. I shall create a 2ED-PR milestone and mark this as such for the time being.
Resolved per WG resolutions and publishing of 2ED-CR2.
@jyasskin please confirm that the merged change at #1203 that has now been published as CR2 does indeed represent an improvement.
Thanks for pinging me.
I do see, for example, "A content processor that downloads external resources during media playback indicates to the origin server of the resource the progress of the user's media consumption." in https://www.w3.org/TR/2021/CR-ttml2-20210309/#d3e59107, which waves toward the fingerprintable preference about playback speed, but it'd be nice to explicitly say how this is sensitive.
https://www.w3.org/TR/2021/CR-ttml2-20210309/#d3e59187 covers the user's preference for fetching captions or subtitles.
I don't see any mention of the "implementation dependent" properties or the clock attributes in the privacy section.
The Timed Text Working Group just discussed TTML2 Mention fingerprinting vectors in privacy considerations. #1189
, and agreed to the following:
SUMMARY: @nigelmegitt to review the vectors in detail and propose how to resolve any gaps.
I have reviewed the vectors described in the issue as per my action and concluded:
The fact that default values for color are implementation dependent does not in itself provide any information. There is no mechanism defined in TTML for querying the used value of color. If some implementation uses e.g. Javascript and CSS, then of the resolved value of the color property returned by getComputedStyle() is the used value, however there is no requirement to use such a technique, and it is out of scope of TTML2 to cover those details, which themselves are features of other W3C specifications.
No action to take.
Already covered in P.3 Resource Fetching
No action to take.
Already covered in P.9 Privacy of Preference
No action to take.
Discussed extensively and covered in P.10 Font Detection
<condition>
resultsPartially covered in P.7 Access to Processing State, but could be strengthened
ACTION: Add to P7 that if conditions expose user preference or device attribute then this increases the fingerprinting surface.
This is not explicitly covered.
ACTION: Add a note about this P.3 Resource fetching.
There is no such mechanism. By reference, media queries are supported, but there is no media query for frame rate. However all media queries are delegated, and this could be made clearer.
ACTION: Add a note to P.7 noting that the set of media queries is defined externally and that any privacy concerns listed there could be applied here too.
The Timed Text Working Group just discussed Mention fingerprinting vectors in privacy considerations. w3c/ttml2#1189
, and agreed to the following:
SUMMARY: @nigelmegitt listed the proposed changes and highlighted them to the group for consideration
I've opened #1231 to fulfil the actions listed at https://github.com/w3c/ttml2/issues/1189#issuecomment-829305696
The Timed Text Working Group just discussed Mention fingerprinting vectors in privacy considerations. w3c/ttml2#1189
, and agreed to the following:
SUMMARY: Group to review as per normal process
Closed after 2nd merge.
If TTML is implemented natively in a user agent, it could expose fingerprinting vectors that aren't otherwise exposed. The spec should mention this risk so native implementations know to make intentional choices. The things I noticed to call out are:
Anything that's "implementation dependent" might be a fingerprinting vector.
<tts:color>
and some others are described as implementation-dependent.A user's preference for how fast they consume media (e.g. 2x vs 2.5x).
The request for timed text indicates the user's language (which is also exposed in other ways) and that the user wants captions or subtitles (which isn't).
The
tts:fontFamily
attribute could expose the system's fonts and should use the same restrictions as CSS.The
<audio>
and<image>
elements probably allow the server to detect the value of any<condition>
expression. Many of thecondition-function
s seem to be already exposed by CSS media queries. Thesupports-function
s probably don't expose any more than the UA string. So this may only be extra fingerprinting surface for UAs that aren't also general web browsers. However, if one of these functions exposes a user preference or device attribute, that would be extra fingerprinting surface.ttp:clockMode==local
probably reveals the local time zone, if only by the timing of embedded resource requests.ttp:timeBase==clock
reveals clock skew in the same way.If there's a way to pull out a display frame rate, that would also help fingerprinting.