How might the browser detect abusive usage of the API to keep the topic dissemination rate in line with expectations?
jkarlin opened this issue · 2 comments
Existing proposal already imposes an upper-bound rate limit...
It is possible for an entity (or entities) to cooperate across hosts and acquire up to 15 topics per epoch for the same user in the first week.
Is the intent to explore how to reduce "15 topics per epoch" even further? What are some example scenarios?
One option would be to require each calling domain to obtain a signature from a known organization, and maintain a public repository of signers and their policies for any key shipped with the browser. If a caller violates the policy and uses Topics API for malicious or non-ad purposes, any keys used to sign it could be dropped from the browser. (This is based on the First-Party Sets proposal) (#87)