Masked Domain List criteria

[brgoldstein]

The Chrome team is requesting feedback from the ecosystem:

The Masked Domain List (MDL) is based on a set of 3 criteria. Are there additional criteria that you would add or criteria that you would want clarified to help improve the MDL to ensure it properly identifies domains that may be tracking a user’s activity across the web?

[patmmccann]

which three criteria; fingerprinting weight seems useful and these seem like useful weights https://github.com/duckduckgo/tracker-radar/blob/main/build-data/generated/api_fingerprint_weights.json#L97

[dmdabbs]

These are the three current inclusion criteria.

[miketaylr]

These are the three current inclusion criteria.

Yep, that's correct. Does that answer your question @patmmccann?

[jameshartig]

I'd like to see a clearer definition of the third criteria. "appears likely" seems extremely vague relative to the rest of the criteria. The criteria does not mention third-party cookies/storage or expressly require domains to operate across contexts. If a third-party domain is exclusively used in a single context, it could "appear" to be able to track users across contexts but in practice, it cannot, because it's only ever used in a single context. For example, siteA.com might embed siteA.analytics.com, which operates exclusively for siteA.com. Additionally, absent of any fingerprinting, which is not mentioned in the criteria explicitly, or third-party cookies/storage, there appears to be little way (outside of obviously malicious behavior, a la local port access/scanning) for it to re-identify visitors across contexts, even if they did happen to operate across multiple contexts.