APA WG comment: fingerprinting of assistive technology users?

[michael-n-cooper]

Apologies for sending this comment after CR, it came from review of an earlier draft. This is a question from the APA Working Group, but if there is a possibility of fingerprinting in the manner described, there could be need for additional action in the specification.

The Accessible Platform Architectures (APA) Working Group has reviewed the First Public Working Draft of the Distributed Tracing specification:

https://www.w3.org/tr/2018/wd-distributed-tracing-20181106/

Our review raised a concern: We want to confirm with you that a user will not be fingerprinted as a person with some disability as a consequence of that person using an assistive technology. Our concern is based on the fact that certain assistive technologies use accessibility APIs to provide access to the web applications, such as the accessible name and/or current value of a widget. Can you please help us understand how this user's privacy would be protected in this situation?

[danielkhan]

Trace Context defines two headers:

1. traceparent: This identifies a transaction that passes through different tiers. This Id MUST be random and does - by definition - not contain any encoded information about a user.
   See also https://www.w3.org/TR/trace-context/#privacy-of-traceparent-field

2. tracestate: A list with key-value pairs that can be used by tracing systems to pass along internal context-related information. The content of the value is opaque and internal to the vendor.
   It MUST NOT contain data that can be used to identify a user.
   It's comparable to the variety of headers (like B3 or x-dynatrace) that vendors pass along today. Usually, it contains information, like the tenant a trace belongs to on the vendor's system.
   See also https://www.w3.org/TR/trace-context/#privacy-of-tracestate-field

Specific to your question about the possibility of browser fingerprinting, I'd like to add that the generation of those headers happens on the server-side when a request hits the backend and not in the browser.

Please let me know if this addresses your concerns.

[AloisReitbauer]

@michael-n-cooper Does this answer your concern?

[michael-n-cooper]

Thanks for the response, and sorry I missed the original reply a couple weeks ago. APA is discussing this, we think the response is helpful but are mulling whether there's anything substantive we thing should be addressed. I expect a final response next week.

[michael-n-cooper]

Thanks, in 17 July 2019 APA WG discussion the APA WG agrees that, while there is a possible concern for privacy, it does not come from this specification. From an APA perspective this comment is addressed.