[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #113 from Jerry Smith <jdsmith@microsoft.com> ---
It's difficult for me to see how a cryptographically secured identifier imposes
a higher risk of identity tracking compared to cookies in general.  If
anything, the steps required to retrieve the CDM identifier make it more
difficult to abuse and less likely to be exploited.  Browsers can further
implement features to reset this identifier, and can allow users to disable the
identifier in general, though with loss of EME functionality.

I agree with comments in this bug about reverting this change.  The
conversation hadn't been concluded, and the consensus in the working group (if
there was one) seemed to be opposition.  I don't believe it is our process to
implement a controversial change and then debate whether it should be retained
or not, especially following open discussion that did not support it.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Monday, 27 October 2014 17:40:48 UTC