这是indexloc提供的服务,不要输入任何密码
Skip to content

requestAdapterInfo() should be required to prompt (in at least some circumstances) #3962

@litherum

Description

@litherum
interface GPUAdapter {
    ...
    Promise<GPUAdapterInfo> requestAdapterInfo(optional sequence<DOMString> unmaskHints = []);
};

interface GPUAdapterInfo {
    readonly attribute DOMString vendor;
    readonly attribute DOMString architecture;
    readonly attribute DOMString device;
    readonly attribute DOMString description;
};

The information in GPUAdapterInfo is significantly privacy-invasive. There are (at least) 2 reasons why:

  1. GPUs are quite varied across the world; there is a lot of diversity/entropy in them
  2. GPU information can be correlated with GPU price, to actually learn about the user's socioeconomic situation, in addition to simply fingerprinting them.

Right now, the spec permits a conformant information to implement requestAdapterInfo() by never prompting, and to give away all this privacy-invasive information to anyone who asks for it, regardless of first-party or third-party or anything else. If authors develop using such a browser, they could easily be led astray by the expectation that this information is freely available, when it won't be in all browsers.

It might be a valid use case for a AAA renderer to request this information to trigger different codepaths for different hardware inside their engine. However, as evidenced by the fact that use of AAA WebGL is fairly rare compared to the number uses of WebGL in total across the web, we expect that AAA WebGPU will be fairly rare compared to all the uses of WebGPU in total across the web. Most WebGPU content across the web likely won't need this information. Indeed; if the authors of most WebGPU content feel they need this information, that means that us implementors have collectively done a terrible job at implementation.

Also, for AAA situations, the user already knows what they are getting themselves into, and wants to enable the AAA experience - they'll be willing to click through a prompt to do so.

So, there's a natural split: most uses won't need this information, and for the uses for which the authors think they need it, those uses are ones that a prompt should be readily accepted by a user.

There are, of course, some situations where it doesn't make sense for requestAdapterInfo() to show a prompt. For example, if the user is logged in to Facebook and they want to play a Facebook game, there's no point prompting in that situation. We're not proposing that requestAdapterInfo() always prompt; we're proposing that there is always some situation where a prompt will occur, and that this prompt will be common enough for web authors to recognize that this privacy-sensitive data isn't freely available (in any browser).

The goal here isn't to solve fingerprinting; the goal is to add one more fingerprinting mitigation to carry us further on the path toward making fingerprinting less and less practical, across the whole web.

Metadata

Metadata

Assignees

No one assigned

    Labels

    apiWebGPU API

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions