Intent to Extend Origin Trial: Trust Token API (Take 2)
Steven Valdez
Contact emails
sva...@chromium.org, privacy...@chromium.org
Spec
https://docs.google.com/document/d/1TNnya6B8pyomDK2F1R9CL3dY10OAmqWlnCxsWyOBDVQ/edit
https://github.com/WICG/trust-token-api
Summary
This is a new API for propagating a notion of user authenticity across sites, without using cross-site persistent identifiers like third party cookies. Trust Token is built on Privacy Pass for anonymous tokens that can't be tracked between issuance and redemption.
An Origin Trial for Trust Token started in M84 and is scheduled to end in M91. Due to the difficulty in spinning up issuers and additional changes and platform support to the API based on feedback during the earlier parts of the OT, we are looking to extend the origin trial again to get additional feedback and data. We would like to extend the Origin Trial to M94.
Link to “Intent to Prototype” blink-dev discussion
https://groups.google.com/a/chromium.org/g/blink-dev/c/X9sF2uLe9rA/
Previous Intent to Extend: https://groups.google.com/a/chromium.org/g/blink-dev/c/eXQq11lrAGU/m/EdY0ltBKBQAJ
Goals for experimentation
For the continuation of the origin trial, we hope to get more feedback on third-party token-derived signals usage for fraud detection without 3P-cookie based schemes. As a result of the feedback so far, we're focusing on trying to improve the ergonomics of third-party issuance, particularly from issuers that don't have a strong first-party signal on particular websites and instead are primarily third-party. Additionally, we are continuing to iterate on the Trust Token API modes (having added a new public metadata-only mode and looking into adopting protocol changes to potentially support more efficient constructions) available based on feedback.
Experimental timeline
We'd like to extend the Origin Trial again to run to the end of M94.
Any risks when the experiment finishes?
As this feature is only available via Origin Trials and doesn't affect any existing state, we don't believe there will be any risks once the experiment concludes. We are still making backwards incompatible changes between Trust Token versions (https://github.com/WICG/trust-token-api/blob/main/ISSUER_PROTOCOL.md#version-history) based on ecosystem feedback, so don't believe there are any risks of ecosystem burn-in as issuers and redeemers have to respond to the change in Trust Token versions support over the course of the Origin Trial. Notably we have a backwards-incompatible change in M92 planned for changing key commitment formats and the primary signing algorithms.
Reason this experiment is being extended
https://groups.google.com/a/chromium.org/forum/?oldui=1#!msg/blink-dev/UIvia1WwIhk/DuXLKdF7AgAJ
Due to the complexities of spinning up issuers and the limited access to crypto libraries, experimentation by other ecosystem participants and other UAs has been slow as they roll out their issuer implementations. There's been some luck with the additional development time and the availability of demo issuers/libraries (https://github.com/google/libtrusttoken) to support the API and we've seen a number of issuers request inclusion in the OT experiment in the last couple months, and there are a couple issuers beginning to ramp up their experiments in the coming month. We'd like to extend the experiment a few more releases to be able to gather additional feedback and data on the API from these new participants. Additionally we've also added WebView support and would like some time for consumers of the API on that platform to determine its ergonomics.
Ongoing technical constraints
None.
Will this feature be supported on all five Blink platforms supported by Origin Trials (Windows, Mac, Linux, Chrome OS, and Android)?
Yes.
Link to entry on the feature dashboard
Mike West
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CANduzxD59Jv1P5kPCGifoUD0Ofq%3DFeOFXbJ950HRZCiPYma83w%40mail.gmail.com.