Guten TAG!

I'm requesting a TAG review of the general concept of migrating high-entropy HTTP request headers to the Client Hints infrastructure. I have two concrete proposals that I think make sense, but they make the most sense together as part of a broader story about reducing the passive fingerprinting surface available to both network attackers and servers.

• Explainer, Requirements Doc, or Example code:

  • https://github.com/mikewest/ua-client-hints suggests that we split User-Agent into UA, UA-Platform, UA-Arch, and UA-Model Client Hints.
  • https://github.com/mikewest/lang-client-hint suggests that we turn Accept-Language into a Lang Client Hint.

• Primary contacts: @mikewest, @thiemonagel

Further details (optional):

• Relevant time constraints or deadlines: None
• I am passingly familiar with the Self-Review Questionnare on Security and Privacy.
• I have reviewed the TAG's API Design Principles

You should also know that there's some active disagreement about the value of Client Hints generally. We had a number of discussions on the topic at TPAC, and I hope I'm not overstating things to suggest that there was some level of agreement that the infrastructure of Client Hints might be a reasonable one to support, even in the face of substantial disagreement about the specific hints that the infrastructure might support.

We'd prefer the TAG provide feedback as (please select one):

• open issues in our Github repo for each point of feedback
• open a single issue in our Github repo for the entire review
• leave review feedback as a comment in this issue and @-notify [github usernames]

Thanks folks! You're still my favorite architectural review body in the W3C!