Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rewrite privacy considerations section #215

Merged
merged 21 commits into from
Oct 25, 2022
Merged
Changes from 19 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 33 additions & 10 deletions index.html
Original file line number Diff line number Diff line change
Expand Up @@ -423,6 +423,15 @@ <h2>
angle=] in degrees as an {{unsigned short}}.
</td>
</tr>
<tr>
<td>
<dfn>[[\initialType]]</dfn>
</td>
<td>
Represents the screen's [=Screen/current orientation type=]
when the [=browsing context=] was created.
</td>
</tr>
<tr>
<td>
<dfn>[[\type]]</dfn>
Expand Down Expand Up @@ -642,6 +651,10 @@ <h2>
<li>Let |screenOrientation| be |context|'s [=associated
`ScreenOrientation`=].
</li>
<li>Initialize |screenOrientation|'s
{{ScreenOrientation/[[initialType]]}} internal slot to the screen's
[=Screen/current orientation type=].
</li>
<li>Initialize |screenOrientation|'s {{ScreenOrientation/[[type]]}}
internal slot to the screen's [=Screen/current orientation type=].
</li>
Expand Down Expand Up @@ -898,30 +911,40 @@ <h2>
applications must advise the user of the orientation requirements.
</p>
</section>
<section class="informative">
<section>
<h2>
Privacy and Security Considerations
</h2>
<p>
A screen's [=Screen/current orientation type|type=] and
[=Screen/current orientation angle|angle=] are a potential
fingerprinting vector. To resist fingerprinting (e.g., in private
browsing), user agents MAY:
fingerprinting vector. The following mitigation help protect a user's
privacy by not revealing how a device is being held, and also prevents
the [=secondary=] orientation type and associated angles from being
user for fingerprinting purposes.
</p>
<p>
To resist fingerprinting (e.g., in private browsing), user agents MAY:
</p>
<ol>
<li>Depending on the screen's aspect ratio, always return either
<li>For the life of a [=top-level browsing context=], behave as as if
screen's [=natural=] orientation is
{{ScreenOrientation/[[initialType]]}}.
</li>
<li>Restrict the possible return values of the
{{ScreenOrientation/type}} getter to
{{OrientationType/"portrait-primary"}} or
{{OrientationType/"landscape-primary"}}.
{{OrientationType/"landscape-primary"}}. The screen aspect ratio
determines which is returned.
</li>
marcoscaceres marked this conversation as resolved.
Show resolved Hide resolved
<li>Always return `0` for the value of the {{ScreenOrientation/angle}}
attribute.
<li>If the [=Screen/current orientation type=] matches
{{ScreenOrientation/[[initialType]]}}, return `0` for the the
marcoscaceres marked this conversation as resolved.
Show resolved Hide resolved
{{ScreenOrientation/angle}} getter. Otherwise, return `90`.
</li>
marcoscaceres marked this conversation as resolved.
Show resolved Hide resolved
<li>If the screen orientation changes, only fire the
<a data-link-for="ScreenOrientation">change</a> event when the
[=Screen/current orientation type=] changes from [=portrait=] to
[=landscape=], or vice versa. This both protects user's privacy by
not revealing how a device is being held, and prevents using the
[=secondary=] orientation as a fingerprinting vector.
[=landscape=], or vice versa.
</li>
</ol>
</section>
Expand Down