Define fingerprinting vector

[zcorpan]

Fixes #20.

---

This is blocked by speced/bikeshed#964

---

Preview | Diff

[annevk]

Hey, @othermaciej left some useful feedback in whatwg/html#3054 (comment) that suggests we should maybe rename this to "tracking vector" or some such.

[othermaciej]

I think it might be useful to define both "fingerprinting vector" and "tracking vector" as a superset of "fingerprinting vector". The current definition seems to be just about fingerprinting. But we need a way to tag features like LocalStorage and BroadcastChannel, and those are tracking but not fingerprinting.

[annevk]

@othermaciej should those exist separately? And do we want separate icons for both? Or would annotating all with "tracking vector" and mention the specifics on a per feature basis be sufficient?

[othermaciej]

@annevk I am not sure. Browsers may care about fingerprinting vectors and other tracking vectors at different levels. For Safari/WebKit, we care about both, but recognize that fully mitigating fingerprinting is a harder problem. Marking the two cases differently might help get better review from interesting parties.

Note: to be consistent, probably every stateful storage mechanism that exists in the web platform should be marked "tracking vector", including but not necessarily limited to: Session Storage, Local Storage, Cache API, HTTP cookies, IndexedDB, the HTTP cache, HSTS, HTTP ETags, SQL Storage, plugins (since many have their own storage mechanisms), CSS visited link history, Service Workers, Shared Workers.

(I realize not all of these are defined or even mentioned in WHATWG Living Standards or other standards that make use of Infra).

[annevk]

I'd like to push this forward as I think this is rather relevant these days. To keep it simple I suggest we go with "tracking vector" exclusively, defining it such that it is inclusive of fingerprinting. If at some point we establish that we need more categories we can cross that bridge then.

[npdoty]

I don't have strong feelings on "tracking vector" vs. "fingerprinting vector" or defining/using them both. But if we start with just "tracking vector" are we going to stick with fingerprint-style icons? Or do we need a different iconography for the more generic term?

[annevk]

I'm fine with keeping the icon Simon created and using it for a broader purpose, but we could replace it if someone is able to create something suitable under CC0.

[zcorpan]

I now think the fingerprint image I created looks kinda ugly, so I wouldn't mind a competing proposal. 🙂

[annevk]

I'd be happy to replace it if someone were to offer something under an equivalent license. Otherwise though, I'd rather move ahead with this than wait for something better to appear.

[othermaciej]

I left some comments on the assumption that this would be generalized to "tracking vector".

(To be clear, I strongly support adding this material to Infra, my comments are more about not making it sound like fingerprinting is the only tracking vector, and also about not justifying interest-based targeting, since it's not necessarily agreed to be benign.)

[jyasskin]

I've confirmed in a local build that the tracking vector paragraph gets a fingerprint icon, so no more need to wait for speced/bikeshed#964 (comment).

[annevk]

Well, I'd like it to also link and use the remote icon and such.

[jyasskin]

Yep, but Bikeshed's link will go to text that this PR is adding, so merging this shouldn't block on that.

[annevk]

I suppose that's true, although the styling leaves to be desired. whatwg/whatwg.org#64 fixes that, but does depend on the other changes.

Is there a reason to merge this early? Hopefully @tabatkins will soon be able to address the remaining issues.

[annevk]

Tab has now done so and will add the link to Infra once this PR is merged. That seems fine as only HTML is impacted and HTML does not depend on Bikeshed. I've created speced/bikeshed#1578 so we can start using an external image here. I'll also check all the other PRs again to ensure everything is in order for the big switch.

[annevk]

As there's always one more thing: speced/bikeshed#1586.

[annevk]

Apologies for the commit title. Fortunately the description does mention "tracking vector" so git log --grep won't miss it.

I was too enthusiastic about finally being able to land this.