Re: The mandatory constraint is a footgun

On 12/11/2013 8:09 PM, Stefan Håkansson LK wrote:
> Do you include the values as well (I mean: it is likely that width and 
> height will be supported, but do you include their respective min and 
> max values)? I ask, because one argument against getCapabilities in 
> the past has been around fingerprinting. You can get info without the 
> user at all getting to know about it. That is not a problem when using 
> optional constraints with gUM (because the user would be presented 
> with the consent prompt). It is a little problematic with mandatory 
> constraints with gUM because the app could repeat gUM with lower and 
> lower reqs, but eventually the user would get informed (because the 
> constraints can be met).

I'm going to go out on a limb and say that, in this case, fingerprinting 
concerns are lower priority than the value of a good API design. 
Exposing webcam resolutions is no more of a fingerprint risk than 
exposing the monitor resolutions (which browsers already do). I also 
feel that fingerprinting concerns are a losing battle. My impression is 
that browsers already leak sufficient information to fingerprint 
clients. Case in point: https://panopticlick.eff.org/

Adding webcam resolutions won't break the camel's back. We should avoid 
exposing information when there are reasonable alternatives, but in this 
case I believe it is necessary.

Gili

Received on Wednesday, 13 November 2013 01:32:40 UTC