Re: Device enumeration, Fingerprinting and other privacy risks

On Oct 12, 2012, at 17:42 , Harald Alvestrand <harald@alvestrand.no> wrote:

> On 10/11/2012 12:16 PM, Robin Berjon wrote:
>> 
>> The use cases for device enumeration are far fewer and farther apart than those for capturing images. The risks are also lower, but not to be disregarded nevertheless. Device enumeration without user consent is exactly like making users walk around the street all day every day with a t-shirt listing the devices that they own. Device enumeration with user consent is less problematic, but it still amounts to walking into a shop and telling people how much you earn.
> Well, many of us walk around all day showing off stuff that gives discerning people a strong hint about how much we earn; we call them "clothes".

That's it, we can improve our privacy by walking around naked. 

Seriously, I think we need to pick the right balance here. The actually video coming off your camera that we are going to send to the other side provides a huge amount of information about the price of the camera. 

If you have have a desk with multiple monitors each with build in cameras, and other camera that say you use for a document camera, you are going to want to control the selection. (This is a fairly common scenario) The way you want to control the selection is very different for an application that uses multiple camera vs and application that just gets one camera so I am pretty skeptical that the browser dialogs for camera permission and selection are going to provide a good user experience. I'm fine with the idea that only an trusted applications could see the list of cameras. Speaker are another good example. Lots of people want the same applications to put different classes of sounds to different speakers.

Received on Sunday, 28 October 2012 06:51:24 UTC