Include malicious PII extraction in description of today

Resolve #4.  Thanks @ehsan.

README.md

@@ -8,7 +8,7 @@ The identity model of the web has been the implicit result of two interacting br
 
 *   _In-browser passing of information_, among the parties co-occurring on a web page (via mechanisms like shared state in DOM or JS, or HTTP redirects, or postMessage).
 
-This combination has led to widely-shared cross-site identities, and so to an ability to perform web-wide tracking of a person's browsing activity.  Global static identifiers (like [device fingerprinting](https://github.com/bslassey/privacy-budget) or user-provided PII) also offer an independent path to global identity.  Limitations on cookies, fingerprinting, and other browser state all aim to reduce this ability to create or access a global identity.
+This combination has led to widely-shared cross-site identities, and so to an ability to perform web-wide tracking of a person's browsing activity.  Global static identifiers (like [device fingerprinting](https://github.com/bslassey/privacy-budget), or like PII provided by or [covertly taken from](https://github.com/michaelkleber/privacy-model/issues/4#issue-484194625) the person browsing) also offer an independent path to global identity.  Limitations on cookies, fingerprinting, and other browser state all aim to reduce this ability to create or access a global identity.
 
 On the one hand, global identity gives rise to the capacity to weave together a record of much of a person's browsing history, a core privacy concern with today's web.  Browsers are well-positioned to take action on this issue, by imposing limits on the underlying capabilities exposed to developers.  On the other hand, global identity also plays a substantial role in today's web advertising ecosystem.  Browsers that impose limitations on these technical capabilities can directly affect [publishers' economic viability](https://www.blog.google/products/ads/next-steps-transparency-choice-control/) and encourage work-arounds, if they haven't provided for the legitimate needs of the ecosystem.