Security/privacy consideration: cross-origin linkage

[wseltzer]

Since all origins displayed to a device will share the same pattern of device orientation changes, this API may provide an avenue for cross-origin correlation. If that threat can't be mitigated, it should at least be noted (and user agents may want to disable access or provide users a means to disable access to these data)

[dontcallmedom]

one way to mitigate this (which would also help with the TouchSignatures attack) would be to restrict DeviceOrientation to visible browsing context.

[gmandyam]

I believe this topic is related to #30, and to the statement by Marcos Caceres in http://lists.w3.org/Archives/Public/public-geolocation/2017Apr/0001.html. I believe the issue raised is valid and real, but I am not detecting a consensus as to how to address it in the specification (beyond what is already in https://w3c.github.io/deviceorientation/spec-source-orientation.html#security-and-privacy, which as Marcos points out is non-normative).

[rakuco]

I believe this has been addressed by 4f91c34, which made the Security & Privacy section normative. Said section contains the following excerpt:

Furthermore, to minimize privacy risks, the chance of fingerprinting and other attacks the implementations must:

• fire events only when a navigable's active document's visibility state is "visible",

which matches the suggestion in #33 (comment)

[rakuco]

#140 has added the visibility checks to the algorithms themselves, which was the last missing part. I think we can finally close this one!