Move elements of pointerId informative note to normative text

[patrickhlauke]

x-ref #405 https://www.w3.org/2021/09/01-pointerevents-minutes.html#t02

---

Preview | Diff

[patrickhlauke]

felt that the part about the lifetime of the page etc was still quite important, so grafted it into the normative part. we can discuss this week at the meeting

[mustaqahmed]

Does it look a bit less hand-wavy?

...MUST NOT be influenced by existing pointers in any other... (emphasis marks the new text)

Not sure if this would leave something important out!

[patrickhlauke]

discussed at today's meeting, needs a bit more finessing:

• need to clarify that mouse pointerId can be unique (and is, though the value differs across implementations)
• bring forward the rationale for doing it (tracking prevention)

[patrickhlauke]

@mustaqahmed @smaug---- @flackr made an admittedly wordy stab at turning the whole explanation around to make it clearer, while also introducing the new idea that mouse's pointerId can be reserved and always the same (it's what Chrome and Firefox do) but without specifying any particular value. thoughts appreciated ... it still feels super dense, but maybe it IS clearer?

[patrickhlauke]

note to self: this PR will need a more descriptive title when/if it gets merged

[mustaqahmed]

The major part of this PR is covered by WPTs. The few remaining points seem hard to test: most are optional, others need multiple top-level browsing contexts (needs discussion). Below is a dump of the pointerId section with my comments:

User agents MAY reserve a generic pointerId value of 0 or 1 for the primary mouse pointer.

Optional, hence untestable.

The pointerId value of -1 MUST be reserved and used to indicate events that were generated by something other than a pointing device.

Covered in *_is_a_pointerevent.html.

For any other pointers, user agents are free to implement different strategies and approaches in how they assign a pointerId value. However, all active pointers in the top-level browsing context must be unique, and the identifier MUST NOT be influenced by any other top-level browsing context (i.e. one top-level browsing context cannot assume that the pointerId of a pointer will be the same when the pointer moves outside of the browsing context and into another top-level browsing context).

Is there a way to have multiple top-level browsing contexts in a WPT?

The user agent MAY recycle previously retired values for pointerId from previous active pointers, or it MAY always reuse the same pointerId for a particular pointing device (for instance, to uniquely identify particular pen/stylus inputs from a specific user in a multi-user collaborative application).

Optional, hence untestable.

However, in the latter case, to minimize the chance of fingerprinting and tracking across different pages or domains, the pointerId MUST only be associated explicitly with that particular pointing device for the lifetime of the page / session, and a new randomized pointerId MUST be chosen the next time that particular pointing device is used again in a new session.

We can simulate a touch pointer crossing an iframe boundary multiple times and can swap iframe content during this interaction. But this is complicated, and the MUST here is conditional!

[mustaqahmed]

Is there a way to have multiple top-level browsing contexts in a WPT?

In a past PEWG meeting, we agreed this may be testable using a same origin popup but it is not clear if "moving a pointer from one browsing context to another" is even supported by test-driver actions.

Removing the needs-wpt label because the major part of the PR is covered by WPTs already.