When the light goes on

We aren't going to say anything other than:

[active] The browser MUST provide noticeable indicia when actively
capturing media from a device.

[potential] The browser MUST provide indicia when a site has a nascent
ability to capture from a device without a user consent prompt.

This has several ramifications: persistent grants of consent will show
the second indicator persistently.  This could be used as a hook to
enable revocation of consent.

Non-persistent grants of consent can be paused somehow.  We didn't
agree on the precise control surface.  I have proposed the use of
"MST.enabled" for this.  That causes the active indicator to disappear
but the potential indicator remains.  For a non-persistent grant, only
the track ending causes the indicia to disappear.

There was a concern that the browser would be unable to reacquire a
lock on the device once the track is resumed.  This is a valid
concern, but one that exists any time that the hardware light goes off
anyway and it was determined that the hardware light going off was a
desirable property from this solution.  The browser might implement a
browser-local lock that would prevent other sites from acquiring the
camera, which wouldn't protect from other applications on the machine
grabbing the device, but it would prevent some failure modes.

Received on Monday, 19 May 2014 20:28:14 UTC