autocomplete=device-eid and =device-imei

[saschanaz]

Request for Mozilla Position on an Emerging Web Specification

• Specification title: Autocomplete tokens for EID and IMEI
• Specification or proposal URL (if available): autocomplete tokens for EID and IMEI whatwg/html#9884
• Explainer URL (if available):
• Proposal author(s) (@-mention GitHub accounts): @annevk
• Caniuse.com URL (optional):
• Bugzilla URL (optional):
• Mozillians who can provide input (optional): @smaug---- @zcorpan @tantek

Other information

[jgraham]

According to the filed issue:

It's not expected that general purpose user agents support autofill for these identifiers.

We expect these to be useful in select operating system or trusted application flows whereby the operating system can guarantee the information is shared, provided the user consents, with a trusted party.

It's unclear to me what exactly is meant by "operating system or trusted application flows" here. In general it seems like there are two possibilities:

• This includes web sites i.e. things that can be reached in a general purpose web browser via a URL. In this case it's not obvious how trust is being assigned to these websites, or why general purpose web browsers aren't expected to implement the proposal.

• This is exclusively for non-web use cases that happen to be using HTML.

In the former case it sounds like an obvious compatibility hazard to attempt to standardise features that are only intended to work in some user agents. In the latter case, it seems out of scope for WHATWG. In particular the workstream document describes the scope of HTML as (emphasis mine):

A kitchen sink full of technologies for the web, including the core markup language for the web, HTML, as well as numerous APIs like Web Sockets, Web Workers, localStorage, etc.

This suggests to me that if the proposal isn't for general web use it also isn't suitable for inclusion in HTML.

[annevk]

The autofilling aspects need a fair amount of guardrails given the sensitivity of the data, but in principle the mechanism can work in general purpose user agents and it's definitely expected to be implemented by websites you can reach via a URL.

[zcorpan]

We think this proposal would set a precedent of adding a privacy-sensitive feature to HTML that don't apply to general-purpose UAs. Your comment above says it could be implemented in a general-purpose UAs, but based on the text
@jgraham quoted it seems there's no such plan.

If such a plan materializes, we can reevaluate.