KEMBAR78
[css-color-4] Prevent fingerprinting with deprecated system colors · Issue #3873 · w3c/csswg-drafts · GitHub
Skip to content

[css-color-4] Prevent fingerprinting with deprecated system colors #3873

@AmeliaBR

Description

@AmeliaBR

In #3804, we agreed to un-deprecate system colors that have important use cases for accessibility (high contrast mode) and dark mode theming.

I'd like to suggest that the spec get more strict about what "deprecated" means for the remaining colors. Specifically, user agents should not expose any user-specific data through the deprecated color names; they should standardize the values for these colors so that they can't be used as fingerprinting data. The colors could still be adjusted for browser & OS, with light & dark mode variants, since that doesn't expose any new information relative to what's already exposed by user agent strings and media queries.

Of the colors that we are keeping deprecated, the problematic one that I know of is Background. In the spec, this is the "desktop background". On my windows system, both Firefox and EdgeHTML do expose my custom OS desktop background color. Chrome instead exposes my custom OS theme accent color. Which are sufficiently different that I can't see any user benefit from theming to match my colors, but I can see a significant fingerprinting vector.

PS, Codepen with all the system colors & their definitions, on various colored backgrounds, if you want to poke around to see what is being exposed for you

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions