imageURL privacy

[AxelNennker]

Should the spec mention that retrieving the image from a site leaks information to that site?

Should the platform show the image only after user consent is given that a credential should be created if the imageURL is not a data URL?

Should the spec recommend that the image should be retrieved once and the image data be stored by the platform? What if the user updates the image at the RP?

Should the imageURL be constrained to secure-contexts?

[rlin1]

In the original proposal, this URL needed to be converted to a data url before being sent to the authenticator.
In my opinion, updates (or "remote" URLs are ok when they refer to the same RP, i.e. ETLD+1)

[AxelNennker]

I did not find a discussion here in the issues list. Was this discussed and consciously removed?
@rlin1 would you suggest text regarding this issue?

[jcjones]

[TPAC 2016] Options: Restrict to same-origin as the credential; Specify the time of load so it won't correlate to user action; Limit to data-urls ...

[leshi]

What if we just remove the icon altogether? Save some space on the authenticator. The selection UI will be okay -- there is still a username.

We'll gain privacy and lose complexity...

[AxelNennker]

Please remind me, why isn't icon part of PublicKeyCredentialUserEntity?

I think it is valuable to have icon images e.g. if the authenticator is implemented on a smart watch or smart phone.

My opinion:
The origins of the icon URL and the RP origin MUST match.
The icon URL must be secure.
Passing icon data to the Authenticator is optional.
The Conforming User Agent MAY re-scale the image data before passing it to the Authenticator.
The Conforming User Agent MUST NOT pass non-image data or unsupported image data to the Authenticator. If the Conforming User Agent passes any image data to the Authenticator then PNG MUST be supported.
If the icon data is passed to the Authenticator then the Conforming User Agent MUST download the icon data once at makeCredential-time and convert it to a "data:image/png;base64" before passing it to the authenticator.
If the icon data is NOT passed to the Authenticator but the Conforming User Agent provides an UI that shows the image then the Conforming User Agent SHOULD download the icon data once at makeCredential-time and SHOULD not download it again to protect the privacy of the user.

[AngeloKai]

@AxelNennker icon is part of PublicKeyCredentialUserEntity. This object inherits from the PublicKeyCredentialEntity.

[AngeloKai]

@leshi From what I read, the account chooser UI is better because it incorporates the image. @selfissued and other identity folks can comment more on the UI.

I am not sure if we are actually gaining privacy. At the end of the day, image is just another piece of data. The RP already supplies the name of the user, which can be used to identify the user. Comparatively image is probably more difficult to be use for privacy attacks. In the meantime, adding icon adds a lot of UX improvement (from what I heard).