Privacy implications

[ghost]

This was raised at several points during httpbis's Thursday meeting by a few people when comparing the draft to NetInfo. Thus, we should aim to do a better job of explaining:

• The use cases we have for this header.
• Clear considerations in the security considerations (or a separate privacy considerations) section that explains these concerns, and offer several mitigations against fingerprinting:
  • Only including necessary values
  • Providing lower-resolution, or less-accurate figures within a threshold that reduces precision
  • Other mitigations within the request flow like always using TLS, only on authenticated requests, header scrubbing, etc.

[ghost]

After talking to @piersoh, I think we need to break the privacy concerns into two parts:

• What is sent, and put language to implementors suggesting data minimisation (only send the data points you need)
• Triggering - only send the header when it is needed, ideally because the client has signalled it requires it. This might be done as say, Accept, or Client Hints but I'm unsure if either of these are appropriate. Implementors could always use other means such as hosting a specific path that is requested, query string parameters, etc and we probably should not be prescriptive and that this should be an informational part of the document.