Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve fingerprinting of screen fold changes #46

Closed
darktears opened this issue Dec 2, 2020 · 1 comment · Fixed by #75
Closed

Improve fingerprinting of screen fold changes #46

darktears opened this issue Dec 2, 2020 · 1 comment · Fixed by #75
Labels
privacy-tracker Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response.

Comments

@darktears
Copy link
Contributor

darktears commented Dec 2, 2020

From blink-dev thread: https://groups.google.com/a/chromium.org/g/blink-dev/c/prHGPxF62i4

"Second, screen fold changes (either via onchange or polling) are an ephemeral fingerprinting vector. Given this API is meant for responsive design, we recommend limiting it to visible browsing contexts. I see section 7.2 does constrain onchange for UX reasons. It should also be listed under “Security and Privacy considerations”. The mitigation should also be applied to other ways to query the property, such as polling. (Perhaps defer all updates to the page’s copy of the state until visible, not just the onchange event, or leave the APIs and CSS queries unavailable to hidden pages altogether.)"

@samuelweiler samuelweiler added the privacy-tracker Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response. label Jan 14, 2021
@samuelweiler
Copy link
Member

@darktears Thank you for raising this and #45. I've flagged both for tracking by PING, and I expect PING will upgrade both to -needs-resolution.

kenchris added a commit to kenchris/device-posture that referenced this issue Jun 3, 2021
kenchris added a commit that referenced this issue Jun 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
privacy-tracker Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants