Yes, we've internally discussed how this can increase precision in fingerprinting.

The result of these discussions resulted in mitigations that address this: https://github.com/oyiptong/compute-pressure#minimizing-information-exposure

The main thrusts are as follows:

The UA can control how many bits of entropy by decided on how many thresholds are accepted from an observer request, effectively determining the number of "buckets" of information to expose
The values returned are "quantized" relative to the requested thresholds
The observer requests are rate-limited
The values returned are normalized within a known range
Per-core information is aggregated into a single value for both utilization and speed

We are also applying some mitigations in our implementation, e.g. only allowing access to the API in visible pages, having a different update rate for visible tabs than for those that aren't visible, etc.

We can also discuss implementation details if you're interested.

On Wed, May 5, 2021 at 12:13 PM Alex Christensen <achristensen@apple.com> wrote:

Has anyone discussed how this can increase the precision of fingerprinting? It seems to reveal more information or more precise information about what else is going on on a user’s system.

On May 5, 2021, at 11:37 AM, Olivier Yiptong via webkit-dev <webkit-dev@lists.webkit.org> wrote:

Hello WebKit devs,

We'd like to get WebKit's position on the Compute Pressure API.

Description:

We propose a new API that conveys the utilization of CPU resources on the user's device. This API targets applications that can trade off CPU resources for an improved user experience. For example, many applications can render video effects with varying degrees of sophistication. These applications aim to provide the best user experience, while avoiding driving the user's device in a high CPU utilization regime.

High CPU utilization is undesirable because it strongly degrades the user experience. Many smartphones, tablets and laptops become uncomfortably hot to the touch. The fans in laptops and desktops become so loud that they disrupt conversations or the users’ ability to focus. In many cases, a device under high CPU utilization appears to be unresponsive, as the operating system may fail to schedule the threads advancing the task that the user is waiting for.

Thanks!

Specification Title: Compute Pressure API
Specification URL: https://oyiptong.github.io/compute-pressure/
Explainger: https://github.com/oyiptong/compute-pressure/blob/main/README.md
ChromeStatus.com entry: https://chromestatus.com/features/5597608644968448
TAG design review request: https://github.com/w3ctag/design-reviews/issues/621
Mozilla Request for Position: https://github.com/mozilla/standards-positions/issues/521
_______________________________________________
webkit-dev mailing list
webkit-dev@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-dev