Re: [mediacapture-main] fixed, per origin, device ID creates tracking risk (#607)

> In Chromium, the labels are the same for all domains (provided it's the same devices) and (together with a cookie) are probably as good for tracking as device IDs .

I think im getting lost in the conversation.  Here is a summary, as I understand it, of where things stand:

1) `enumerateDevices` will instead return on entry per device type (audio, video, etc), and that entry will have neither labels not device IDs
2) Once a user gives a site access, the site can learn the true label for the device

The parts I'm still not following are whether we're getting closer to agreement on the following items:
1) Modifying the standard to make the deviceID double keyed (note my understanding is that the WG _already_ agreed to make this change during the previous HR)
2) Coming up with some handle that a site can use to re-access a device the user has already given access to that _isn't_ a persistent, unique global identifier.  I've offered some suggestions (maybe naive) on how this could be done above.  Having the browser maintain and present globally unique long term identifiers to sites would be a uniquely new privacy harm in the browser, so working out some other option here seems unavoidable.

Will look forward to having more of this conversation at TPAC in ~3 weeks, but happy to do anything i can in advance to try and come to agreement here / before hand

-- 
GitHub Notification of comment by snyderp
Please view or discuss this issue at https://github.com/w3c/mediacapture-main/issues/607#issuecomment-526712372 using your GitHub account

Received on Friday, 30 August 2019 18:59:38 UTC