[Privacy-pass] The harms of popular bits

[Watson Ladd <[e-mail]>]

Dear privacy pass WG,

I think the discussion of harms in the web context missed the issue, which
I'll admit was rather subtly presented. Issuers might not be issuing tokens
based on attributes like bot or not but rather characteristics such as race
or religion we'd prefer not to. This even happens innocently.

Using private state tokens as an example social networks and dating sites
have a lot of information about user interaction and humanity as a result.
But I don't think we want sites to hunt for tokens from dating sites that
may be oriented to particular demographics.

This can even happen unintentionally. If you have some sort of model
looking at how users interact based on the bits you have and then selecting
offers to show based on it this can end up discriminating even though the
bit officially means human. It's just who issued it reveals more than that,
even if they issue often.

I hope this clarifies the remarks I made at the mic.

Sincerely,
Watson