diff --git a/index.html b/index.html index 19b3b12..e2d9f81 100644 --- a/index.html +++ b/index.html @@ -265,8 +265,8 @@

Sampling and Reporting Rate

supported or accepted by the underlying platform and [=user agent=].

- It is recommended that the [=user agent=] limits the [=reporting rate=] - as outlined in [[[#rate-limiting-change-notifications]]]. + The specification additionally obfuscates the rate as outlined + in [[[#rate-obfuscation]]].

In case the user didn't request a [=sampling rate=], the [=sampling rate=] @@ -1751,7 +1751,7 @@

Timing attacks

or very precise values can be accessed at the same time by sites not sharing origin. - This attack is mitigated by [[[#data-minimization]]], [[[#rate-limiting-change-notifications]]], + This attack is mitigated by [[[#data-minimization]]], [[[#rate-obfuscation]]], and [[[#same-origin-restriction]]].

Cross-site covert channel

@@ -1766,8 +1766,8 @@

Cross-site covert channel

This process is repeated as long as the scripts run on both the sites A and B.

- This attack is mitigated by [[[#rate-limiting-change-notifications]]], [[[#rate-obfuscation]]] and - [[[#break-calibration]]]. Implementers are advised to consider all these mitigations for long-running scripts. + This attack is mitigated by [[[#rate-obfuscation]]] and [[[#break-calibration]]]. + Implementers are advised to consider all these mitigations for long-running scripts.

The longer the scripts run the more information can be transmitted using the proposed cross-site covert channel. @@ -1841,37 +1841,7 @@

Data minimization

The specific application of data minimization principles in the context of this specification - are discussed in [[[#rate-limiting-change-notifications]]] and [[[#same-origin-restriction]]]. -

-

Rate-limiting change notifications

-

- By rate-limiting the delivery of the pressure state information we remove the - attacker's ability to observe the precise time when a value transitions between two states. -

-

- More precisely, once the pressure observer is activated, it will be - called once with initial values, and then is called when the values change. - The subsequent calls will be rate-limited. When the callback is - called, the most recent value is reported. -

-

- The specification will recommend a rate limit of at most one call per second - for the active window, and one call per 10 seconds for all other windows. We - will also recommend that the call timings are jittered across origins. -

-

- These measures benefit the user's privacy, by reducing the risk of - identifying a device across multiple origins. The rate-limiting also benefits - the user's security, by making it difficult to use this API for timing attacks. - Last, rate-limiting change callbacks places an upper bound on the performance - overhead of this API. -

-

- Rate limiting can be implemented in the user agent, but it might also be - possible to simply change the polling/sampling rate of the underlying hardware - counters, if not accessed via a higher level framework. -

-
+ are discussed in [[[#rate-obfuscation]]] and [[[#same-origin-restriction]]].

Rate obfuscation