Merge pull request #177 from miketaylr/issues/144/2

Issue #144 - Add fingerprinting to Security & Privacy considerations section

README.md

@@ -458,7 +458,7 @@ We hope that alternative methods or APIs will exist to address the
 spam filtering and bot detection use cases in the future, as browsers may decide
 to intervene on behalf of their users by limiting the collection of
 user-identifying entropy (e.g., the
-[Privacy Budget](https://github.com/bslassey/privacy-budget proposal).
+[Privacy Budget](https://github.com/bslassey/privacy-budget) proposal).
 
 ### Persistent user tracking
 This is a case of fingerprinting that this proposal *explicitly tries to make

index.bs

@@ -491,12 +491,22 @@ of a given agent's behavior over time.
 Delegation {#delegation}
 ----------
 
-Client Hints will be delegated from top-level pages via Feature Policy. This reduces the likelihood that [=user agent=]
+Client Hints will be delegated from top-level pages via Permissions Policy. This reduces the likelihood that [=user agent=]
 information will be delivered along with subresource requests, which reduces the potential for
 passive fingerprinting.
 
 That delegation is defined as part of [=append client hints to request=].
 
+Fingerprinting {#fingerprinting}
+--------------
+
+The primary goal of User Agent Client Hints is to reduce the default entropy
+available to the network for passive fingerprinting. However, it will still be possible
+for some, or all, hints to be requested and used for active fingerprinting purposes by
+first or delegated third parties. As noted in [[#access]], [=User agents=] should consider
+policies to restrict or reduce access to parties that are known to actively
+fingerprint their users.
+
 Access Restrictions {#access}
 -------------------