Re: [art] Alissa Cooper's No Objection on draft-ietf-appsawg-mdn-3798bis-15: (with COMMENT)

[Alexey Melnikov <[e-mail]>]

Hi Alissa,


On 30/11/2016 15:22, Alissa Cooper wrote:

> = Section 6.2.2 =
>
> "The "Reporting-UA" field (Section 3.2.1) might contain enough
>     information to uniquely identify a specific device, usually when
>     combined with other characteristics, particularly if the user agent
>     sends excessive details about the user's system or extensions.
>     However, the source of unique information that is least expected by
>     users is proactive negotiation, including the Accept-Language header
>     fields."
>
> I think the use of "However" is tripping me up here. Earlier in the
> document you have good recommendations about how to mitigate the risk of
> fingerprinting based on the Reporting-UA field. That guidance is valid
> regardless of whether other header fields might also contribute to
> fingerprinting or whether users would expect that (frankly, I don't see
> how user expectations are relevant here, since most users don't
> understand fingerprinting anyway). I think something along the following
> lines to replace the last sentence above would be more accurate: "Even
> when the guidance in Section 3.2.1 is followed to avoid fingerprinting,
> other sources of unique information may still be present, including the
> Accept-Language header fields."
This was copied from an HTTP RFC, but you have a point. I used a variant 
of your text (I changed "including" to "such as").

Best Regards,
Alexey