zlacker

>>luag+(OP)
> We had proposed a hold-back to prevent lock-in at the platform level. Essentially, some percentage of the time, say 5% or 10%, the WEI attestation would intentionally be omitted, and would look the same as if the user opted-out of WEI or the device is not supported.

So, does that mean that sites would need to fallback to existing practices for these users (or for custom forks)? So, these users get the worse ux and that's considered "supporting custom browsers"? Now sites can spend less time and resources on detection, but wait...what about the 5-10%? So IT departments will be less likely to spend precious dev time and funding on improving detection due the overall risk reduction. I'm not sure that's a net win.

>>Madcap+HZ
Seems like it. Also that everyone will eventually end up fingerprinted if they browse for long enough, because the holdback is randomly enabled on a per-(client,site) basis.