This repository was archived by the owner on Nov 3, 2025. It is now read-only.
Repository navigation
This repository was archived by the owner on Nov 3, 2025. It is now read-only.
Masked Domain List criteria #69
Description
The Chrome team is requesting feedback from the ecosystem:
The Masked Domain List (MDL) is based on a set of 3 criteria. Are there additional criteria that you would add or criteria that you would want clarified to help improve the MDL to ensure it properly identifies domains that may be tracking a user’s activity across the web?
Activity
patmmccann commentedon Feb 12, 2025
which three criteria; fingerprinting weight seems useful and these seem like useful weights https://github.com/duckduckgo/tracker-radar/blob/main/build-data/generated/api_fingerprint_weights.json#L97
dmdabbs commentedon Feb 12, 2025
These are the three current inclusion criteria.
miketaylr commentedon Apr 2, 2025
Yep, that's correct. Does that answer your question @patmmccann?
jameshartig commentedon Jun 12, 2025
I'd like to see a clearer definition of the third criteria. "appears likely" seems extremely vague relative to the rest of the criteria. The criteria does not mention third-party cookies/storage or expressly require domains to operate across contexts. If a third-party domain is exclusively used in a single context, it could "appear" to be able to track users across contexts but in practice, it cannot, because it's only ever used in a single context. For example,
siteA.commight embedsiteA.analytics.com, which operates exclusively forsiteA.com. Additionally, absent of any fingerprinting, which is not mentioned in the criteria explicitly, or third-party cookies/storage, there appears to be little way (outside of obviously malicious behavior, a la local port access/scanning) for it to re-identify visitors across contexts, even if they did happen to operate across multiple contexts.