Re: [mediacapture-main] Devicechange event firing potentially being a fingerprint

Since this thread has some confusion about the specific discussion 
@npdoty brought up, I'm going to include that excerpt from the 
discussion @stefhak points to above:

>>> ### Events
>>> 
>>>> When a new media input or output device is made available, the 
user agent MUST queue a task fires a simple event named devicechange 
at the MediaDevices object.
>>> 
>>> This event appears to be fired even for web pages that have not 
requested any permissions from the user. Is that intended?
>> Yes. However, that was not a very deeply discussed decision - so it
 might be changeable.
>>> 
>>> Particularly if this event will be fired before any permission is 
granted, it is important that it not be fired simultaneously in all 
browsing contexts. Sites can use simultaneous firing to correlate 
browsing activity in different tabs, different windows (including 
private windows), different browsers, in a way that may be unexpected 
to the user and undermine other protections they're attempting to 
implement. Some specs have resolved this problem by noting that the 
event should only be fired for the front-most or active browsing 
context.
>> I'm not sure how this would work for availability of devices - it 
would be strange indeed if my comms client would only notice new 
devices if it was the foreground tab.
>
>I'm not sure I would expect a tab that I wasn't using but had access 
to a microphone to take action immediately upon plugging in a new 
microphone.

Separate and more important, does every tab and iframe that *doesn't* 
have permission to access cameras or microphones need to receive a 
simultaneous event when you plug a camera or microphone in? That seems
 like functionality unlikely to help the user, while making it harder 
to isolate activity via private browsing windows or separate browsers.


-- 
GitHub Notification of comment by josephlhall
Please view or discuss this issue at 
https://github.com/w3c/mediacapture-main/issues/333#issuecomment-209935147
 using your GitHub account

Received on Thursday, 14 April 2016 13:09:48 UTC