diff --git a/index.html b/index.html index 19b3b12..e2d9f81 100644 --- a/index.html +++ b/index.html @@ -265,8 +265,8 @@
- †It is recommended that the [=user agent=] limits the [=reporting rate=] - as outlined in [[[#rate-limiting-change-notifications]]]. + †The specification additionally obfuscates the rate as outlined + in [[[#rate-obfuscation]]].
In case the user didn't request a [=sampling rate=], the [=sampling rate=] @@ -1751,7 +1751,7 @@
- This attack is mitigated by [[[#rate-limiting-change-notifications]]], [[[#rate-obfuscation]]] and - [[[#break-calibration]]]. Implementers are advised to consider all these mitigations for long-running scripts. + This attack is mitigated by [[[#rate-obfuscation]]] and [[[#break-calibration]]]. + Implementers are advised to consider all these mitigations for long-running scripts.
The specific application of data minimization principles in the context of this specification
- are discussed in [[[#rate-limiting-change-notifications]]] and [[[#same-origin-restriction]]].
-
- By rate-limiting the delivery of the pressure state information we remove the
- attacker's ability to observe the precise time when a value transitions between two states.
-
- More precisely, once the pressure observer is activated, it will be
- called once with initial values, and then is called when the values change.
- The subsequent calls will be rate-limited. When the callback is
- called, the most recent value is reported.
-
- The specification will recommend a rate limit of at most one call per second
- for the active window, and one call per 10 seconds for all other windows. We
- will also recommend that the call timings are jittered across origins.
-
- These measures benefit the user's privacy, by reducing the risk of
- identifying a device across multiple origins. The rate-limiting also benefits
- the user's security, by making it difficult to use this API for timing attacks.
- Last, rate-limiting change callbacks places an upper bound on the performance
- overhead of this API.
-
- Rate limiting can be implemented in the user agent, but it might also be
- possible to simply change the polling/sampling rate of the underlying hardware
- counters, if not accessed via a higher level framework.
-
Rate-limiting change notifications
- Rate obfuscation