<!--
Copyright 2023 The Chromium Authors
Use of this source code is governed by a BSD-style license that can be
found in the LICENSE file.
-->
<!--
This file is used to generate a comprehensive list of Trusted Vault histograms
along with a detailed description for each histogram.
For best practices on writing histogram descriptions, see
https://chromium.googlesource.com/chromium/src.git/+/HEAD/tools/metrics/histograms/README.md
Please follow the instructions in the OWNERS file in this directory to find a
reviewer. If no OWNERS file exists, please consider signing up at
go/reviewing-metrics (Googlers only), as all subdirectories are expected to
have an OWNERS file. As a last resort you can send the CL to
[email protected].
-->
<histogram-configuration>
<histograms>
<variants name="SecurityDomainId">
<variant name=".ChromeSync" summary="The security domain used for Zuul"/>
<variant name=".HwProtected" summary="The security domain used for passkeys"/>
</variants>
<histogram
name="TrustedVault.DownloadAuthenticationFactorsRegistrationState{SecurityDomainId}"
enum="DownloadAuthenticationFactorsRegistrationStateResult"
expires_after="2024-12-01">
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<summary>
Records the results of DownloadAuthenticationFactorsRegistrationState calls.
This function determines the recoverability state of a security domain.
It is recorded whenever DownloadAuthenticationFactorsRegistrationState is
called. For passkeys this happens during WebAuthn calls, in some cases
without a Google Password Manager passkey being selected, only present.
</summary>
<token key="SecurityDomainId" variants="SecurityDomainId"/>
</histogram>
<histogram
name="TrustedVault.JavascriptSetClientEncryptionKeysForSecurityDomain"
enum="SecurityDomainId" expires_after="2025-01-31">
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<summary>
Records the security domains passed as arguments to the Javascript API
chrome.setClientEncryptionKeys() on the renderer side (one sample per
security domain; multiple domains can be passed in one API call). Every
unrecognized security domain name is recorded as "invalid".
</summary>
</histogram>
<histogram name="TrustedVault.JavascriptSetClientEncryptionKeysValidArgs"
enum="BooleanValid" expires_after="2025-01-31">
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<summary>
For each invocation of the Javascript API chrome.setClientEncryptionKeys(),
records whether the passed arguments could be successfully parsed (one
sample per invocation).
</summary>
</histogram>
<histogram name="TrustedVault.RecoveryKeyStoreURLFetchResponse{Reason}"
enum="CombinedHttpResponseAndNetErrorCode" expires_after="2025-01-31">
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<summary>
Counts of responses (both http code and net error code) for requests to the
recovery key store server (aka Vault Service). Note that requests that timed
out are not covered by this histogram.
{Reason}
</summary>
<token key="Reason">
<variant name="" summary="Any reason"/>
<variant name=".UpdateRecoveryKeyStore"
summary="Upload a set of recovery keys"/>
</token>
</histogram>
<histogram
name="TrustedVault.SecurityDomainServiceURLFetchResponse{Reason}{SecurityDomainId}"
enum="CombinedHttpResponseAndNetErrorCode" expires_after="2025-01-31">
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<summary>
Counts of responses (both http code and net error code) for requests to the
Trusted Vault server (aka Security Domain Service), broken out by {Reason}
and {SecurityDomainId}. Note that requests that timed out are not covered by
this histogram.
</summary>
<token key="SecurityDomainId" variants="SecurityDomainId">
<variant name="" summary="Any security domain"/>
</token>
<token key="Reason">
<variant name="" summary="Any reason"/>
<variant name=".DownloadAuthenticationFactorsRegistrationState"
summary="Downloading of auth factor registrations"/>
<variant name=".DownloadIsRecoverabilityDegraded"
summary="Downloading of the recoverability-degraded state"/>
<variant name=".DownloadKeys" summary="Downloading of keys"/>
<variant name=".RegisterDevice" summary="Local device registration"/>
<variant name=".RegisterGooglePasswordManagerPIN"
summary="Google Password Manager PIN registration"/>
<variant name=".RegisterICloudKeychain"
summary="Registration of a secret synced by iCloud Keychain"/>
<variant name=".RegisterLockScreenKnowledgeFactor"
summary="Registration of a lock screen knowledge factor (e.g. PIN or
local password)"/>
<variant name=".RegisterUnspecifiedAuthenticationFactor"
summary="Registration of an authentication factor of unspecified type"/>
</token>
</histogram>
<histogram name="TrustedVault.SetEncryptionKeysForSecurityDomain{ProfileType}"
enum="SecurityDomainId" expires_after="2025-01-31">
<owner>[email protected]</owner>
<owner>[email protected]</owner>
<summary>
Records the security domains passed as arguments to the Javascript API
chrome.setClientEncryptionKeys() (or chrome.setSyncEncryptionKeys()) on the
browser side (one sample per passed domain; multiple domains can be passed
in one API call). Every unrecognized security domain name is recorded as
"invalid".
{ProfileType}
</summary>
<token key="ProfileType">
<variant name=".AllProfiles" summary="All profile types"/>
<variant name=".OffTheRecordOnly" summary="Off-the-record profiles only"/>
</token>
</histogram>
</histograms>
</histogram-configuration>
Codebase Browser
chromium