@@ -265,8 +265,8 @@
Sampling and Reporting Rate
265
265
supported or accepted by the underlying platform and [=user agent=]< sup > †sup > .
266
266
p >
267
267
< p >
268
- < sup > †sup > It is recommended that the [=user agent=] limits the [=reporting rate=]
269
- as outlined in [[[#rate-limiting-change-notifications ]]].
268
+ < sup > †sup > The specification additionally obfuscates the rate as outlined
269
+ in [[[#rate-obfuscation ]]].
270
270
p >
271
271
< p >
272
272
In case the user didn't request a [=sampling rate=], the [=sampling rate=]
@@ -1751,7 +1751,7 @@
Timing attacks
1751
1751
or very precise values can be accessed at the same time by sites not sharing
1752
1752
origin.
1753
1753
1754
- This attack is mitigated by [[[#data-minimization]]], [[[#rate-limiting-change-notifications ]]],
1754
+ This attack is mitigated by [[[#data-minimization]]], [[[#rate-obfuscation ]]],
1755
1755
and [[[#same-origin-restriction]]].
1756
1756
p >
1757
1757
< h4 > Cross-site covert channelh4 >
@@ -1766,8 +1766,8 @@
Cross-site covert channel
1766
1766
This process is repeated as long as the scripts run on both the sites A and B.
1767
1767
p >
1768
1768
< p >
1769
- This attack is mitigated by [[[#rate-limiting-change-notifications ]]], [[[#rate-obfuscation ]]] and
1770
- [[[#break-calibration]]]. Implementers are advised to consider all these mitigations for long-running scripts.
1769
+ This attack is mitigated by [[[#rate-obfuscation ]]] and [[[#break-calibration ]]].
1770
+ Implementers are advised to consider all these mitigations for long-running scripts.
1771
1771
p >
1772
1772
< div class ="note ">
1773
1773
The longer the scripts run the more information can be transmitted using the proposed cross-site covert channel.
@@ -1841,37 +1841,7 @@
Data minimization
1841
1841
p >
1842
1842
< p >
1843
1843
The specific application of data minimization principles in the context of this specification
1844
- are discussed in [[[#rate-limiting-change-notifications]]] and [[[#same-origin-restriction]]].
1845
- < section >
1846
- < h4 > Rate-limiting change notificationsh4 >
1847
- < p >
1848
- By rate-limiting the delivery of the pressure state information we remove the
1849
- attacker's ability to observe the precise time when a value transitions between two states.
1850
- p >
1851
- < p >
1852
- More precisely, once the pressure observer is activated, it will be
1853
- called once with initial values, and then is called when the values change.
1854
- The subsequent calls will be rate-limited. When the callback is
1855
- called, the most recent value is reported.
1856
- p >
1857
- < p >
1858
- The specification will recommend a rate limit of at most one call per second
1859
- for the active window, and one call per 10 seconds for all other windows. We
1860
- will also recommend that the call timings are jittered across origins.
1861
- p >
1862
- < p >
1863
- These measures benefit the user's privacy, by reducing the risk of
1864
- identifying a device across multiple origins. The rate-limiting also benefits
1865
- the user's security, by making it difficult to use this API for timing attacks.
1866
- Last, rate-limiting change callbacks places an upper bound on the performance
1867
- overhead of this API.
1868
- p >
1869
- < p >
1870
- Rate limiting can be implemented in the user agent, but it might also be
1871
- possible to simply change the polling/sampling rate of the underlying hardware
1872
- counters, if not accessed via a higher level framework.
1873
- p >
1874
- section >
1844
+ are discussed in [[[#rate-obfuscation]]] and [[[#same-origin-restriction]]].
1875
1845
< section >
1876
1846
< h4 > Rate obfuscationh4 >
1877
1847
< p >
0 commit comments