From 2a8fc0a28c9b39b7e1402646c3bcf6d812c3d583 Mon Sep 17 00:00:00 2001 From: Matt Giuca Date: Fri, 3 May 2024 08:12:44 +1000 Subject: [PATCH] Rewrite privacy considerations on fingerprinting in start_url (#1114) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Rewrite privacy considerations on fingerprinting in start_url. There is a "MUST NOT" requirement for developers about putting user data in the start_url. This is not enforceable, so rewriting the paragraph: 1. Removed this requirement for developers. 2. Added a non-normative note that tells developers it would be irresponsible to do this (but acknowledging that we can't practically prevent it). 3. Added a MAY requirement for user agents to offer to uninstall apps associated with an origin when clearing site data. * Change "UUID" to "identifier" Co-authored-by: Marcos Cáceres * Reword note to developers. Co-authored-by: Marcos Cáceres * Add title to note box. Co-authored-by: Marcos Cáceres --------- Co-authored-by: Marcos Cáceres --- index.html | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/index.html b/index.html index d753038b..24653cea 100644 --- a/index.html +++ b/index.html @@ -817,8 +817,17 @@

This can be useful for analytics and possibly other customizations. However, it is also conceivable that developers could encode strings into the start_url that uniquely identify the user (e.g., a - server assigned UUID). This is fingerprinting/privacy - sensitive information that the user might not be aware of. + server-assigned identifier, such as `"?user=123"`, + `"/user/123/"`, or `"https://user123.foo.bar"`). This is + fingerprinting/privacy sensitive information that the user might + not be aware of. +

+

+ It is bad practice for a developer to use the [=start URL=] + to include information that uniquely identifies a user, as it would + represent a fingerprint that is not cleared when the user clears + site data. However, nothing in this specification can practically + prevent developers from doing this.

Given the above, it is RECOMMENDED that, upon installation, or any @@ -826,9 +835,11 @@

necessary, modify the [=start URL=] of an application.

- Additionally, developers MUST NOT use the [=manifest/start URL=] to include - information that uniquely identifies a user (e.g., "?user=123" or - "/user/123/", or "https://user123.foo.bar"). + A user agent MAY offer other protections against this form of + fingerprinting. For example, if a user clears data from an origin, + the user agent MAY offer to uninstall applications that are + [=manifest/within scope=] of that origin, thus removing the + potential fingerprint from the application's start URL.