Re: [mediacapture-main] fixed, per origin, device ID creates tracking risk (#607)

@guidou

> @snyderp Once permission is given, pages can use the label field to do the tracking, regardless of device IDs.

But these will not be unique to a client though, no?  Would be ideal to not have the site ever learn the label ether, just the handle to refer to it with further, but as long as the site learn the label _after_ permission is granted, and the label is not unique to the client, then I'm far less concerned.

> 2. If the embedded iframe is in the same domain, yes. If it's a cross-domain iframe, no.

What happens when the same 3p frame (i.e. third-party.com) appears in two different 1p domains?  (i.e. are we still in a single key'ed world, or a now a double key'ed world)?

> An extra measure that can be taken to prevent tracking when permission has not been given is to list at most one entry per device kind (in addition to showing empty IDs)

This is a terrific idea!

-- 
GitHub Notification of comment by snyderp
Please view or discuss this issue at https://github.com/w3c/mediacapture-main/issues/607#issuecomment-524951201 using your GitHub account

Received on Monday, 26 August 2019 17:29:07 UTC