Add Privacy and Security Considerations section #115

xfq · 2018-05-08T03:49:19Z

Fix #96.

One question I haven't answered yet is:

How should this specification work in the context of a user agent’s "incognito" mode?

I don't know how implementations behave in this case.

Preview | Diff

Fix #96.

marcoscaceres · 2018-05-08T05:25:24Z

index.html

+      <h2>
+        Privacy and Security Considerations
+      </h2>
+      <p>


So, I tried doing exactly this format in the past (in a different spec) and people complained. Maybe we can just chop this down to the "yes" stuff, and make a paragraph out of it.

It's pretty useful to have the positive and negative aspects covered, but I agree that it should be readable prose rather than answers to questions whether they are relevant or not...

chaals

This answers the questions posed by the security/privacy questionnaire, but doesn't give much useful information.

I think the point is to explain what someone might do with that information that has an impact on security and privacy.

Although it is potentially possible to lock the orientation of a device, about the only application I can think of where there is an issue is something like a compass, where it is possible to actively mislead the user. In practice, that is already possible with a compass application.

Kowing whether the user is turning their device is indeed a potential fingerprinting vector (like so many things related to sensors, also because it can be corroborated externally, e.g. by processing surveillance video of an area). However, it is a relatively complex and inefficient attack to use - in practice I would not expect to see it deployed unless users become far-more privacy concsious and protect themselves against many simpler attacks.

Remove the "locking the screen orientation" part, since it doesn't seem to have privacy and security impact. Mention the fingerprinting vector.

chaals · 2018-05-29T11:50:11Z

index.html

-        <h2>Control over a user agent’s native UI</h2>
-        <p>
-          This specification allows locking the screen orientation to a specific state.
+          The screen orientation type and angle of the device can be accessed with the API specified in this document, and can be a potential fingerprinting vector.


I think it is worth saying how weak this potential vector is, and that it is unlikely to be used while far stronger ones are available.

IMHO, even trying to use this in association with other data is difficult, except real-time comparison of external visual surveillance or device-orientation.

For example, adding

Using this information for practical fingerprinting is very difficult compared to other fingerprinting information. Aggregating information derived from this API is not very helpful in fingerprinting. The Device Orientation API provides a far more detailed version of the same information. So in practice, this API's minimal fingerprinting potential is unlikely to be used by any competent attack.

(I'll do that as a PR to your branch)

more detailed privacy considerations

xfq · 2018-05-29T22:51:27Z

I'll merge this in one day if there's no objection. Further improvements can be made later :)

marcoscaceres · 2018-05-30T07:02:07Z

(need a few days still to review, sorry!)

marcoscaceres · 2018-05-30T07:06:48Z

index.html

+        <h3>Access to aspects of a user’s local computing environment</h3>
+        <p>
+          The screen orientation type and angle of the device can be accessed with the API specified in this document,
+          and can be a potential fingerprinting vector. However, using this information is very difficult compared to other fingerprinting information. 


Please drop: "However, using this information is very difficult compared to other fingerprinting information."

marcoscaceres · 2018-05-30T07:07:17Z

index.html

+        <p>
+          The screen orientation type and angle of the device can be accessed with the API specified in this document,
+          and can be a potential fingerprinting vector. However, using this information is very difficult compared to other fingerprinting information. 
+          Aggregating information derived from this API is not very helpful in fingerprinting. 


Same with this line.

marcoscaceres · 2018-05-30T07:08:15Z

index.html

+          The screen orientation type and angle of the device can be accessed with the API specified in this document,
+          and can be a potential fingerprinting vector. However, using this information is very difficult compared to other fingerprinting information. 
+          Aggregating information derived from this API is not very helpful in fingerprinting. 
+          In particular the <a href="https://w3c.github.io/deviceorientation/spec-source-orientation.html">DeviceOrientation Event Specification</a> provides a far more detailed version of the same information. 


Same, all this stuff can go. Blaming another spec for being more leaky doesn't help this one :)

marcoscaceres

Making this section minimal would be better.

xfq · 2018-05-31T05:34:59Z

@chaals Any comment on Marcos's comments? Maybe we need some research papers about this topic (see Accelerometer for an example).

In the meantime, I also see fingerprintjs2 detecting the screen orientation to ensure consistent fingerprints when users rotate their mobile devices, although it doesn't use the Screen Orientation API: https://github.com/Valve/fingerprintjs2/blob/f6c39229228831ffb7d84592e0529633f25c0c65/fingerprint2.js#L164

mounirlamouri · 2018-05-31T14:01:58Z

index.html

+          Aggregating information derived from this API is not very helpful in fingerprinting. 
+          In particular the <a href="https://w3c.github.io/deviceorientation/spec-source-orientation.html">DeviceOrientation Event Specification</a> provides a far more detailed version of the same information. 
+          So in practice, this API's minimal fingerprinting potential is unlikely to be used by any competent attack.
+        </p>


I think we can say more than that. The spec provides the following information:

angle

type

Type is landscape / portrait which the website can already figure out with the screen.width and screen.height. The only information the type provides that wasn't available is the distinction between primary and secondary. It may be interesting to look deeper into these two sub-types.

Angle, by definition has a strong correlation with the type value. I wonder if it's worth looking more into it and how it may impact fingerprinting.

I don't think it's correct to say that this API is a sub-set of Device Orientation as Device Orientation, even if more noisy doesn't quite offer the same information.

* Privacy & Security Edits * Formatting * Reworded phrasing

marcoscaceres · 2018-10-11T23:30:32Z

Closed by #121 - @Johanna-hub did the change suggest here. Text is now in the spec. Thanks everyone for your input!

xfq · 2018-10-12T02:13:12Z

Hmm, text is not in the spec now, because Johanna's PR was created against the xfq/priv-sec branch, which is the branch in this PR.

We should either merge both PRs, or rebase #121 against gh-pages...

Reopening this PR; Merging.

marcoscaceres · 2018-10-12T02:16:09Z

Hmm, text is not in the spec now, because Johanna's PR was created against the xfq/priv-sec branch, which is the branch in this PR.

Oh whoops, I should have spotted that.

marcoscaceres · 2018-10-12T02:16:24Z

Thanks @xfq!

Johanna-hub · 2018-10-12T05:50:33Z

Sorry about the confusion @marcoscaceres and @xfq and thanks for fixing. I created my PR against xfq/priv-sec so reviewers could evaluate the changes I made to the original PR. Should I have just used gh-pages branch?

marcoscaceres · 2018-10-12T06:50:30Z

Either would be fine. Just note in a comment which branch it’s going into as it’s easy to miss.

Add Privacy and Security Considerations section

1926e03

Fix #96.

xfq requested review from mounirlamouri and marcoscaceres May 8, 2018 03:49

xfq added the do not merge yet label May 8, 2018

marcoscaceres reviewed May 8, 2018

View reviewed changes

Shorten the P&S section to the "yes" stuff, per @marcoscaceres

512de0a

xfq removed the do not merge yet label May 28, 2018

chaals suggested changes May 28, 2018

View reviewed changes

Tweak the P&S section a bit

b87db76

Remove the "locking the screen orientation" part, since it doesn't seem to have privacy and security impact. Mention the fingerprinting vector.

chaals reviewed May 29, 2018

View reviewed changes

chaals and others added 3 commits May 29, 2018 13:53

more detailed privacy considerations

bc2762f

Update the spec name for deviceorientation

b7d3d15

Merge pull request #116 from w3c/chaals-patch-1

644bd0b

more detailed privacy considerations

marcoscaceres reviewed May 30, 2018

View reviewed changes

marcoscaceres requested changes May 30, 2018

View reviewed changes

mounirlamouri reviewed May 31, 2018

View reviewed changes

Johanna-hub mentioned this pull request Oct 11, 2018

Edit Privacy and Security Consideration Section #121

Merged

Editorial: Privacy and Security Consideration Section (#121)

9e4ec29

* Privacy & Security Edits * Formatting * Reworded phrasing

marcoscaceres closed this Oct 11, 2018

xfq reopened this Oct 12, 2018

xfq merged commit b17bfb3 into gh-pages Oct 12, 2018

xfq deleted the xfq/priv-sec branch October 12, 2018 02:16

xfq mentioned this pull request Oct 12, 2018

Lacks a privacy and security consideration section #96

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Privacy and Security Considerations section #115

Add Privacy and Security Considerations section #115

xfq commented May 8, 2018 •

edited by pr-preview bot

marcoscaceres May 8, 2018

chaals May 28, 2018

chaals left a comment

chaals May 29, 2018

chaals May 29, 2018

xfq commented May 29, 2018

marcoscaceres commented May 30, 2018

marcoscaceres May 30, 2018

marcoscaceres May 30, 2018

marcoscaceres May 30, 2018

marcoscaceres left a comment

xfq commented May 31, 2018

mounirlamouri May 31, 2018

marcoscaceres commented Oct 11, 2018

xfq commented Oct 12, 2018

marcoscaceres commented Oct 12, 2018

marcoscaceres commented Oct 12, 2018

Johanna-hub commented Oct 12, 2018

marcoscaceres commented Oct 12, 2018

Add Privacy and Security Considerations section #115

Add Privacy and Security Considerations section #115

Conversation

xfq commented May 8, 2018 • edited by pr-preview bot

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chaals left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xfq commented May 29, 2018

marcoscaceres commented May 30, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marcoscaceres left a comment

Choose a reason for hiding this comment

xfq commented May 31, 2018

Choose a reason for hiding this comment

marcoscaceres commented Oct 11, 2018

xfq commented Oct 12, 2018

marcoscaceres commented Oct 12, 2018

marcoscaceres commented Oct 12, 2018

Johanna-hub commented Oct 12, 2018

marcoscaceres commented Oct 12, 2018

xfq commented May 8, 2018 •

edited by pr-preview bot