{"action":"created","issue":{"url":"https://api.github.com/repos/w3ctag/security-questionnaire/issues/7","labels_url":"https://api.github.com/repos/w3ctag/security-questionnaire/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/w3ctag/security-questionnaire/issues/7/comments","events_url":"https://api.github.com/repos/w3ctag/security-questionnaire/issues/7/events","html_url":"https://github.com/w3ctag/security-questionnaire/issues/7","id":75339586,"number":7,"title":"Clarify section 3.14 and add Third Party Tracking as an opt-in threat model","user":{"login":"diracdeltas","id":549654,"avatar_url":"https://avatars.githubusercontent.com/u/549654?v=3","gravatar_id":"","url":"https://api.github.com/users/diracdeltas","html_url":"https://github.com/diracdeltas","followers_url":"https://api.github.com/users/diracdeltas/followers","following_url":"https://api.github.com/users/diracdeltas/following{/other_user}","gists_url":"https://api.github.com/users/diracdeltas/gists{/gist_id}","starred_url":"https://api.github.com/users/diracdeltas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diracdeltas/subscriptions","organizations_url":"https://api.github.com/users/diracdeltas/orgs","repos_url":"https://api.github.com/users/diracdeltas/repos","events_url":"https://api.github.com/users/diracdeltas/events{/privacy}","received_events_url":"https://api.github.com/users/diracdeltas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-11T19:59:58Z","updated_at":"2015-05-11T20:39:48Z","closed_at":null,"body":"Migrated from https://github.com/mikewest/spec-questionnaire/issues/6\r\n\r\n@mikeperry-tor wrote:\r\n\r\n> It seems that the question in section 3.14 (\"Does this specification distinguish between behavior in first-party and third-party contexts?\") is very easy to misinterpret or overlook entirely, even though it is absolutely essential to any evaluation of an API from a privacy perspective.\r\n> \r\n> For example, I could easily see a specification that decides that this section is satisfied simply by allowing for the third party script to detect its context, and then decide for itself how it wants to use the API (independent of any considerations of tracking, consent, or user control).\r\n> \r\n> Something like this would be a bit stronger and clearer:\r\n> \r\n> \"At minimum, every new API or feature should be capable of being configured by the user to gracefully degrade into a functional mode of operation that does not allow third party content elements to use it to track unique users between different first party sites. Specifically, any storage, authentication tokens, shared state, and cross-window communication should be capable of being isolated between different first party origins, at user option.\r\n> \r\n> For detailed guidance on how to provide graceful degradation to protect against more subtle forms of tracking that do not involve direct communication or unique identifier storage (aka 'fingerprinting'), we refer the reader to https://w3c.github.io/fingerprinting-guidance/.\"\r\n> In Tor Browser, we've implemented graceful degradation of the browser cache and DOM storage APIs by double keying all entries using both the first party and third party origin. This allows third party elements to continue to use this functionality in iframes and mashups, but prevents them from using the functionality to track users between different first party sites. In other cases, we've simply had to disable offending functionality (due to lack of engineering resources), which obviously has a significant impact on usability when things break.\r\n> \r\n> If new APIs and feature specifications came with graceful degradation modes that did not require disabling them outright, the web would be a much better place.\r\n> \r\n> If it were up to me, I would also elevate \"Third Party Tracking\" to a threat model that users could opt-in to protect themselves against, and specify this in the threat model section. All features should be capable of allowing the user to select this threat model via a single choice in their browser UI that applies to all browser features (instead of being given control only over third party cookies, as is the case today).\r\n> \r\n> I can submit a pull request for this threat model addition if you like.\r\n\r\n@marcoscaceres commented:\r\n> @mikeperry-tor I'm having trouble understanding:\r\n> \r\n> \"At minimum, every new API or feature should be capable of being configured by the user to gracefully degrade into a functional mode of operation that does not allow third party content elements to use it to track unique users between different first party sites.\"\r\n> Can you maybe follow that by a couple of examples to clarify what you mean? Or how it could be done with some other existing APIs?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/w3ctag/security-questionnaire/issues/comments/101041060","html_url":"https://github.com/w3ctag/security-questionnaire/issues/7#issuecomment-101041060","issue_url":"https://api.github.com/repos/w3ctag/security-questionnaire/issues/7","id":101041060,"user":{"login":"diracdeltas","id":549654,"avatar_url":"https://avatars.githubusercontent.com/u/549654?v=3","gravatar_id":"","url":"https://api.github.com/users/diracdeltas","html_url":"https://github.com/diracdeltas","followers_url":"https://api.github.com/users/diracdeltas/followers","following_url":"https://api.github.com/users/diracdeltas/following{/other_user}","gists_url":"https://api.github.com/users/diracdeltas/gists{/gist_id}","starred_url":"https://api.github.com/users/diracdeltas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diracdeltas/subscriptions","organizations_url":"https://api.github.com/users/diracdeltas/orgs","repos_url":"https://api.github.com/users/diracdeltas/repos","events_url":"https://api.github.com/users/diracdeltas/events{/privacy}","received_events_url":"https://api.github.com/users/diracdeltas/received_events","type":"User","site_admin":false},"created_at":"2015-05-11T20:39:47Z","updated_at":"2015-05-11T20:39:47Z","body":"> If it were up to me, I would also elevate \"Third Party Tracking\" to a threat model that users could opt-in to protect themselves against, and specify this in the threat model section. All features should be capable of allowing the user to select this threat model via a single choice in their browser UI that applies to all browser features (instead of being given control only over third party cookies, as is the case today).\r\n> \r\n> I can submit a pull request for this threat model addition if you like.\r\n\r\nI am in favor of this addition."}}