Limiting capability of RenderCapacity API in inactive tabs

[hoch]

During the development in Chrome, some privacy concerns were raised about RenderCapacity API:

My concern is that two tabs receive the same change in buckets at the same time (in this sense, the number of buckets is somewhat irrelevant). This would allow them to, outside the browser, compare timestamps.

The reference: https://github.com/asankah/ephemeral-fingerprinting#limit-api-access-to-focused-top-level-browsing-context

I am curious what other WG members think.

[hoch]

Why does synthesizing signals from multiple tabs matters? Here's a thought:

It's a cross-site reidentification risk: if I run third-party code on two sites, and I witness the same event on both sites at the same time then I can use this along with other cross-site identifiers (e.g. User Agent string, IP address, screen resolution) to determine that the person on both sites is the same person. It's similar to what can be done using third-party cookies.

[hoch]

Teleconference 4/6:
The group had a consensus that throttling the event frequency when a tab is the background. The WG chairs/editors will come up with the spec text to reflect the change.

[hoch]

The simple mitigation proposed above was not effective and the development team of this API is taking a few steps back to work on the new mitigation plan.