EditContext: Are the events for EditContext propagated in the DOM tree?

[masayuki-nakano]

I don't find whether the events for EditContext is fired only in an associated instance of active element as a default action of composition* events or propagated from the DOM tree. I like the former better for making browsers' implementation simpler and saving the propagation cost. However, if so, the events can be attributes of EditContext because I have no idea of adding 2 or more event listeners for same event.

[masayuki-nakano]

Oh, and TextFormatUpdateEvent has a lot of information which are useful for fingerprinting. So, if 3rd party code can listens to the event, it's bad...

[alexkeng]

The compositionstart and compositionend events are fired on EditContext (spec), not on the associated element, so I think we are aligned on this front.

Note that there is no compositionupdate event when EditContext is active since EC's textupdate event already has info for the composition text. There is also no insertCompositionText, insertFromComposition, deleteByComposition, deleteCompositionText since we are not updating DOM.

As for fingerprinting, are you worried about rangeStart/rangeEnd where we are exposing what characters can be combined into a phrase? (I supposed color/underlineStyle/thickness are not related to fingerprinting) But we are already exposing whole composition texts in compositionupdate event, by observing the incremental update of the string I think the 3rd party is already able to determine what characters are treated as a phrase, it can even get all the candidate words as user enumerating in the candidate window (in Japanese IME), so I think textformatupdate event isn't really exposing much more info than what we are already exposing.

[masayuki-nakano]

As for fingerprinting, are you worried about rangeStart/rangeEnd where we are exposing what characters can be combined into a phrase?

No.

(I supposed color/underlineStyle/thickness are not related to fingerprinting)

I worry about this. 3rd party's IME may use different style/color especially on Windows. E.g., ATOK which is a 3rd party's Japanese IME uses light blue background color etc by the default settings. So the new leaking information may let trackers know which IME is used.

[BoCupp-Microsoft]

This feels like an acceptable tradeoff to me. Users that are actively composing will also now have enough information exposed for authors to render that text properly onto their editing canvas.

UAs could also choose to alter the styles before dispatching textformatupdate. It may be acceptable to do so to ensure contrast or combat fingerprinting. We could add a note in the spec that UAs are free to make such adjustments?

[masayuki-nakano]

UAs could also choose to alter the styles before dispatching textformatupdate. It may be acceptable to do so to ensure contrast or combat fingerprinting.

makes sense, for example, tor developers would do it.

We could add a note in the spec that UAs are free to make such adjustments?

Yeah, should be there.