Skip to content

Editorial: mark DefaultLocale as a fingerprinting vector #997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 5, 2025

Conversation

ryzokuken
Copy link
Member

Add a normative note to the DefaultLocale AO to indicate that it can be used as a fingerprinting vector in browser environments.

Fixes #110

@ryzokuken ryzokuken added the editorial Involves an editorial fix label Apr 23, 2025
@ryzokuken ryzokuken requested a review from sffc April 23, 2025 15:15
@ryzokuken ryzokuken self-assigned this Apr 23, 2025
@ryzokuken
Copy link
Member Author

@sffc I tried taking a (rather minimal) stab at your comment at #110 (comment). Let me know how the phrasing feels.

@ryzokuken ryzokuken requested a review from gibson042 April 23, 2025 15:17
Copy link
Contributor

@sffc sffc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This conveys the intent, I think. Mainly I want the spec to require that DefaultLocale derives from navigator.languages, such that DefaultLocale does not introduce any new entropy.

Add a normative note to the DefaultLocale AO to indicate that it can be used as a fingerprinting vector in browser environments.

Fixes tc39#110

Co-authored-by: Richard Gibson <[email protected]>
@ryzokuken ryzokuken merged commit 6caa3fb into tc39:main May 5, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
editorial Involves an editorial fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Consider marking DefaultLocale as a fingerprinting vector
3 participants