4 ms·

Because most users don't want that level of granularity. Do you really want to have to give every single site you touch permission to know your screen resolutio

by ebbv 10y ago

Because most users don't want that level of granularity. Do you really want to have to give every single site you touch permission to know your screen resolution, viewport, browser type, browser version, js enabled/disabled, fonts available, whether jquery/etc. are cached, etc. There are so many pieces of data like those that you don't even think about which combine to make you uniquely identifiable. Many of them the site is going to have to know for the page to even render properly. Do you really want to have to give permissions for all of them for every host name your browser contacts? Even if your answer is yes, for the vast majority of people the answer is no.

MasterScrat 10y ago
But I think it would be the right way to do it. Maybe you could have some permissive settings by default, but it would be good to have an easy way to let you pick what you want to communicate and to whom. For example I don't think such a popup for battery level would be a problem. Very few websites legitimately need it, and for those who don't requesting it is a red flag.
dingaling 10y ago
> Many of them the site is going to have to know for the page to even render properly Which illustrates that something has gone very wrong in the logical division between "the site" and "the user agent". Technically, the site has no business asking about screen resolution, cache status or installed fonts etc That is information which should be relevant only to the user agent in constructing the view for the user. But browsers do not make a distinction between rendering-domain data and those data which do validly dictate what functionality the site provides to the user agent. Except for location, which is somehow perceived as sacred. Which brings us back to the original question; why are all the data elements thrown into the general Javascript bucket and made fair game for grabbing, except location data? Why not draw the boundary around data that should be private to the user agent? The user should never be interrupted by a prompt to share a list install fonts because, frankly, that information should never be divulged.

by ebbv 10y ago

MasterScrat 10y ago

But I think it would be the right way to do it. Maybe you could have some permissive settings by default, but it would be good to have an easy way to let you pick what you want to communicate and to whom. For example I don't think such a popup for battery level would be a problem. Very few websites legitimately need it, and for those who don't requesting it is a red flag.

dingaling 10y ago

> Many of them the site is going to have to know for the page to even render properly Which illustrates that something has gone very wrong in the logical division between "the site" and "the user agent". Technically, the site has no business asking about screen resolution, cache status or installed fonts etc That is information which should be relevant only to the user agent in constructing the view for the user. But browsers do not make a distinction between rendering-domain data and those data which do validly dictate what functionality the site provides to the user agent. Except for location, which is somehow perceived as sacred. Which brings us back to the original question; why are all the data elements thrown into the general Javascript bucket and made fair game for grabbing, except location data? Why not draw the boundary around data that should be private to the user agent? The user should never be interrupted by a prompt to share a list install fonts because, frankly, that information should never be divulged.