timezonechange event could enable cross-origin tracking via simultaneous background event firing (whatwg/html#3047)

w3cping / tracking-issues

Repo to track PING initiated issues on other standards documents.

https://w3c.github.io/horizontal-issue-tracker/?repo=w3cping/tracking-issues

12 stars 2 forks source link

timezonechange event could enable cross-origin tracking via simultaneous background event firing (whatwg/html#3047) #34

Open npdoty opened 4 years ago

npdoty commented 4 years ago

A new event to be triggered when the user's timezone changes (as opposed to polling) could have privacy implications if the event is fired in all tabs/browsing contexts simultaneously. Discussion also notes that there may be other events with similar properties in HTML. We previously noted this with Idle API, Proximity, Ambient Light, generic Sensor API and MediaCapture.

This is a threat we should add to threat model or other guidance documents.

§ https://github.com/whatwg/html/pull/3047

npdoty commented 4 years ago

my comments:

Discussion is happening in this pull request, rather than an issue: https://github.com/whatwg/html/pull/3047

samuelweiler commented 4 years ago

also discussed re: GamePad https://github.com/w3c/gamepad/issues/74#issuecomment-433403518

jyasskin commented 4 years ago

I've mentioned this more generally in https://w3cping.github.io/privacy-threat-model/#cap-visible-for-browser-event, and @asankah discussed it in detail in https://asankah.github.io/ephemeral-fingerprinting/.