Can SXG be used to track users?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 125
- PR merge metrics
- No merged PRs in 30d
Description
Scenario is the following:
- User A goes to site S and gets a SXG
- User A shares the SXG to user B
- User B loads the SXG
- Site S learns that there is a connection between user A and user B.
Overall, SXG seems to ask publishers to use SXG so that content is not user-specific.
But there is currently no way for users to ensure that this is the case.
One possible solution is some kind of SXG transparency, as added https://github.com/WICG/webpackage/pull/381.
It is not clear whether that will scale though.
Another possibility is to get such a proof from the server itself.
A specific credential less request from user B to the signed URL or to an URL generated from it by the client could do the trick. Liveness check could also piggy back on such a request.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the scenario and the linked transparency pull request, https://github.com/WICG/webpackage/pull/381. The issue presents transparency and server-issued proof as possible directions but does not identify an implementation entry point, tests, or agreed acceptance criteria.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100