Wordsmithing for 2025 #69

tomrittervg · 2025-01-17T20:32:54Z

Addresses #68

Some of these changes are more syntactic than semantic, I tried to limit those but a few still jumped out to me.

index.html

- Strengthing wording to describe fingerprinting as a threat - Mentioning VPNs as a common privacy tool that does not help - Stripping mentions of plugins. - Mention advances in CSS-based fingerprinting - Mention the differences between client-side fingerprint calculation and server-side - Mention User Gesture - Various other small wordsmiths

npdoty

Good updates and improvements, thanks!

jyasskin

2 nits and a note:

index.html

jyasskin · 2025-02-06T20:44:06Z

index.html

-              Permanent identifiers or other state (for example, identifiers or keys set in hardware) should typically not be exposed. Where necessary, access to such identifiers would require user permission (however, explaining the implications of such permission to users may be difficult) and limitation to a particular origin (however, server-side collusion between origins will be difficult to detect).
-              As a result, your design should not rely on saving and later querying data on the client beyond a user's clearing cookies or other local state. That is, you should not expect any local state information to be permanent or to persist longer than other local state.
+              Permanent identifiers or other state (for example, identifiers or keys set in hardware) should typically not be used. Where necessary, access to such identifiers would require user permission and limitation to a particular origin. However even heavy-weight mitigations are imperfect: explaining the implications of such permission to users may be difficult and server-side collusion between origins is typically impossible to detect.
+              As a result, your design should not rely on saving and later querying data on the client and expecting it to persist beyond a user clearing cookies or other local state. That is, you should not expect any local state information to be permanent or to persist longer than other local state.


No particular change needed in this PR, but we do have features that encourage some local state to persist longer than other state. Passwords in the password manager, especially, but also https://storage.spec.whatwg.org/#dom-storagemanager-persist and https://github.com/WICG/storage-buckets/blob/main/explainer.md help websites give different lifetimes to different state, and I think that's all consistent with privacy.

Co-authored-by: Jeffrey Yasskin <jyasskin@gmail.com>

chrisn · 2025-02-07T17:32:19Z

index.html

@@ -257,8 +263,9 @@ <h3 id="passive">Passive</h3>
        </section>
        <section>
          <h3 id="active">Active</h3>
-          <p>For <dfn>active fingerprinting</dfn>, we also consider techniques where a site runs JavaScript or other code on the local client to observe additional characteristics about the browser, user, device or other context.</p>
-          <p>Techniques for active fingerprinting might include accessing the window size, enumerating fonts or plug-ins, evaluating performance characteristics, reading from device sensors, and rendering graphical patterns. Key to this distinction is that <a>active fingerprinting</a> takes place in a way that is potentially detectable on the client.</p>
+          <p>For <dfn>active fingerprinting</dfn>, we also consider techniques where a site runs JavaScript or other code on the local client to observe additional characteristics about the browser, user, device or other context. In recent years numerous techniques have ab(used) CSS features to perform fingerprinting on par with JavaScript.</p>


Suggested change

For <dfn>active fingerprinting</dfn>, we also consider techniques where a site runs JavaScript or other code on the local client to observe additional characteristics about the browser, user, device or other context. In recent years numerous techniques have ab(used) CSS features to perform fingerprinting on par with JavaScript.

For <dfn>active fingerprinting</dfn>, we also consider techniques where a site runs JavaScript or other code on the local client to observe additional characteristics about the browser, user, device or other context. In recent years numerous techniques have (ab)used CSS features to perform fingerprinting on par with JavaScript.

chrisn · 2025-02-07T17:33:46Z

index.html

-          <p>Techniques for active fingerprinting might include accessing the window size, enumerating fonts or plug-ins, evaluating performance characteristics, reading from device sensors, and rendering graphical patterns. Key to this distinction is that <a>active fingerprinting</a> takes place in a way that is potentially detectable on the client.</p>
+          <p>For <dfn>active fingerprinting</dfn>, we also consider techniques where a site runs JavaScript or other code on the local client to observe additional characteristics about the browser, user, device or other context. In recent years numerous techniques have ab(used) CSS features to perform fingerprinting on par with JavaScript.</p>
+          <p>Techniques for active fingerprinting might include accessing the window size, enumerating fonts or connected devices, evaluating performance characteristics, reading from device sensors, and rendering graphical patterns. Key to this distinction is that <a>active fingerprinting</a> takes place in a way that is potentially detectable on the client.</p>
+          <p>Note that in some types of active fingerprinting, characteristics are combined on the client to produce a fingerprint. In most cases; however, the characteristics are sent en masse to a server, which can combine them in unobservable ways.  The latter mechanism may be detectable, but the efficacy of fingerprinting mitigation techniques is much harder to measure in this scenario.


Suggested change

Note that in some types of active fingerprinting, characteristics are combined on the client to produce a fingerprint. In most cases; however, the characteristics are sent en masse to a server, which can combine them in unobservable ways. The latter mechanism may be detectable, but the efficacy of fingerprinting mitigation techniques is much harder to measure in this scenario.

Note that in some types of active fingerprinting, characteristics are combined on the client to produce a fingerprint. In most cases however, the characteristics are sent en masse to a server, which can combine them in unobservable ways. The latter mechanism may be detectable, but the efficacy of fingerprinting mitigation techniques is much harder to measure in this scenario.

chrisn · 2025-02-07T17:36:20Z

index.html

@@ -319,23 +326,23 @@ <h2 id="identifying">Identifying fingerprinting surface and evaluating severity<
      <p id="severity-list">For each identified feature, consider the severity for the privacy impacts described above (<a href="#privacy_threat_models"></a>) based on the following factors:</p>

      <dl>
-        <dt>entropy</dt><dd>How distinguishing is this new surface? Consider both the possible variations and the likely distribution of values. Adding 1-bit of entropy is typically of less concern; 30-some bits of entropy would be enough to uniquely identify every individual person. Different data sources may provide different distributions of variation; for example, some characteristics may reveal a common hardware class while other characteristics may reveal user configurations that vary between individual people.</dd>
+        <dt>entropy</dt><dd>How distinguishing is this new surface? Consider both the possible variations and the likely distribution of values. Adding 1-bit of entropy is typically of less concern; 30-some bits of entropy would be enough to uniquely identify every individual person. Different data sources may provide different distributions of variation; for example, even 1 bit of entropy can uniquely identify a user if they are the only one for whom it is true.</dd>


Suggested change

<dt>entropy</dt><dd>How distinguishing is this new surface? Consider both the possible variations and the likely distribution of values. Adding 1-bit of entropy is typically of less concern; 30-some bits of entropy would be enough to uniquely identify every individual person. Different data sources may provide different distributions of variation; for example, even 1 bit of entropy can uniquely identify a user if they are the only one for whom it is true.</dd>

<dt>entropy</dt><dd>How distinguishing is this new surface? Consider both the possible variations and the likely distribution of values. Adding 1 bit of entropy is typically of less concern; 30-some bits of entropy would be enough to uniquely identify every individual person. Different data sources may provide different distributions of variation; for example, even 1 bit of entropy can uniquely identify a user if they are the only one for whom it is true.</dd>

tomrittervg force-pushed the 2025-01-17-tjr-wordsmithing branch from beca6c7 to 37049b7 Compare January 17, 2025 20:39

This was referenced Jan 17, 2025

Should we add a warning about entropy? #40

Open

should we further mitigate threats of identifiers in local storage because some mechanisms won't clear all local storage? #43

Open

npdoty reviewed Jan 28, 2025

View reviewed changes

index.html Outdated Show resolved Hide resolved

tomrittervg force-pushed the 2025-01-17-tjr-wordsmithing branch from 37049b7 to a5bdb3d Compare January 28, 2025 16:27

npdoty approved these changes Jan 28, 2025

View reviewed changes

jyasskin approved these changes Feb 6, 2025

View reviewed changes

tomrittervg and others added 2 commits February 7, 2025 10:14

Add comma

d641a2b

Co-authored-by: Jeffrey Yasskin <jyasskin@gmail.com>

unique -> uniquely

e6bbe93

Co-authored-by: Jeffrey Yasskin <jyasskin@gmail.com>

chrisn reviewed Feb 7, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Wordsmithing for 2025 #69

Wordsmithing for 2025 #69

tomrittervg commented Jan 17, 2025

npdoty left a comment

jyasskin left a comment

jyasskin Feb 6, 2025

chrisn Feb 7, 2025

chrisn Feb 7, 2025

chrisn Feb 7, 2025

	<p>For <dfn>active fingerprinting</dfn>, we also consider techniques where a site runs JavaScript or other code on the local client to observe additional characteristics about the browser, user, device or other context. In recent years numerous techniques have ab(used) CSS features to perform fingerprinting on par with JavaScript.</p>
	<p>For <dfn>active fingerprinting</dfn>, we also consider techniques where a site runs JavaScript or other code on the local client to observe additional characteristics about the browser, user, device or other context. In recent years numerous techniques have (ab)used CSS features to perform fingerprinting on par with JavaScript.</p>

	<p>Note that in some types of active fingerprinting, characteristics are combined on the client to produce a fingerprint. In most cases; however, the characteristics are sent en masse to a server, which can combine them in unobservable ways. The latter mechanism may be detectable, but the efficacy of fingerprinting mitigation techniques is much harder to measure in this scenario.
	<p>Note that in some types of active fingerprinting, characteristics are combined on the client to produce a fingerprint. In most cases however, the characteristics are sent en masse to a server, which can combine them in unobservable ways. The latter mechanism may be detectable, but the efficacy of fingerprinting mitigation techniques is much harder to measure in this scenario.

Wordsmithing for 2025 #69

Are you sure you want to change the base?

Wordsmithing for 2025 #69

Conversation

tomrittervg commented Jan 17, 2025

npdoty left a comment

Choose a reason for hiding this comment

jyasskin left a comment

Choose a reason for hiding this comment

jyasskin Feb 6, 2025

Choose a reason for hiding this comment

chrisn Feb 7, 2025

Choose a reason for hiding this comment

chrisn Feb 7, 2025

Choose a reason for hiding this comment

chrisn Feb 7, 2025

Choose a reason for hiding this comment