In T340995#9198712, @kostajh wrote:

I propose this task as a candidate to keep in the backlog. If we want to show it in Special:Investigate, we should first gather some data on Special:Investigate usage (compared to Special:CheckUser) to justify the development time. We could also ask (cc @KColeman-WMF) CheckUser users if this is more important than other tasks in the backlog.

@Dreamy_Jazz and I reviewed existing API usage, and as it is very low, we are going to put this into someday/maybe.

@Dreamy_Jazz anything else we want to do for this task? I think the existing config and limits look OK.

@Dreamy_Jazz this task can be declined, AIUI, because we are not using CheckUserUnionSelectQueryBuilder

My vote is to put this into the Someday / Maybe column.

@Milimetric can we close this task?

Closing in favor of QA on T340991 and T340993

In T340995#9198712, @kostajh wrote:

I propose this task as a candidate to keep in the backlog. If we want to show it in Special:Investigate, we should first gather some data on Special:Investigate usage (compared to Special:CheckUser) to justify the development time. We could also ask (cc @KColeman-WMF) CheckUser users if this is more important than other tasks in the backlog.

The frequency is low enough (45 in last 7 days) that I am not too concerned. What do you think?

Declining this per https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/955809/25#message-c0074c8d0b92ada57bb444033cc6c0a483e93764.

In T274633#9130878, @Soda wrote:

In T274633#9130354, @kostajh wrote:

In T274633#9130270, @Soda wrote:

I would personally (as a user) would be extremely against this being implemented. Wikimedia/Wikipedia should not be a platform that should perform invasive JS based (font-support detection/Web-GL based) fingerprinting on it's users regardless of it's usecase (as opposed to passive fingerprinting via UA hints and basic api support detection which is what is being done/proposed untill now).

@Soda thanks for commenting on this. Would you mind elaborating further about what level of fingerprinting you think would be acceptable, and why? For example, there are fingerprinting techniques that can be done without JavaScript (explainer) that one could also argue are as invasive as JavaScript-based techniques.

I think a good rule of thumb would be to consider any active fingerprinting method to be off-limits. Feature detection would be okay since this information is something that the browser explicitly provides, but actively (ab)using the web-gl API or using font detection techniques (which is one of the techniques that the no-js demo uses) or cache supercookies would be a definite no.

Another more user centric rule of thumb (that will be more difficult to quantify) would be to see how unique the resulting fingerprinting is (calculating the entrophy of a fingerprinting). If we are able to semi-reliably uniquely identify every single person/device in the world, we are clearly crossing some boundaries.

I propose to close this and T242825: Deal with Google Chrome User-Agent deprecation. Related tasks can be tracked in Google-Chrome-User-Agent-Deprecation.

@Milimetric, do we need to keep this task open?