Permission-hint? (was Re: [Bug 22214] How long do permissions persist?)

On 5/14/14 8:49 AM, Harald Alvestrand wrote:
>> On 5/30/13 9:48 AM, bugzilla@jessica.w3.org wrote:
>>> 4.  Suppose the app requests a camera and the user gives it permission to use
>>> all cameras.  The app initially uses only a single camera but later decides
>>> that it wants a different one.  Does it have to request permission again (given
>>> that the user granted permission for all cameras)?
> On 03/19/2014 03:34 PM, bugzilla@jessica.w3.org wrote:
>> I think it's an UA design choice whether permission is given for a 
>> particular
>> camera or for all cameras.

I agree it is a UA design choice, but I could use some help avoiding 
"grant all".

Specifically, I wish an app could hint that it might ask for more 
cameras later, to reduce dialog-fatigue.

Problem case A (please ignore camera-selectors in permission-prompts 
here [1]):

 1. User launches webapp Foo on their mobile.
 2. Mobile says "Foo wants to use your front camera. Allow/Deny -
    Remember my choice[x]"
 3. User touches "Allow", with "Remember my choice [x]" checked.
 4. User sees self and touches the "<->" back/front flip button that Foo
    has.
 5. It says "Foo wants to use your rear camera. Allow/Deny - Remember my
    choice[x]"
 6. User curses and touches "Allow" again, with "Remember my choice [x]"
    checked.


Given that Foo has a "flip" button (and is using constraints), it seems 
superior to ask the user for both cameras upfront here (B=both):

 1. User launches webapp Foo on their mobile.
 2. Mobile says "Foo wants to use both of your cameras. Allow/Deny -
    Remember my choice[x]"
 3. User touches "Allow" with "Remember my choice [x]" checked.
 4. User sees self and pushes the "<->" back/front flip button that Foo has.
 5. User sees the Eiffel Tower.


Of course, we could always do B but it discourages "minimal access" 
apps. For example: "Foo wants to use your front camera. Allow/Deny?" is 
more comforting in a BossTalk app, if my boss doesn't know I'm in Paris.

Here's one idea: We could put in a hint [2], like:

     getUserMedia({ video: { askPermissionFor:"one"|"all" } }, success, 
failure);

which UAs would be free to ignore.

Or we could interpret a lack of constraints to mean "prefer grant-all" - 
which I'm considering - but it seems like an overload.

Thoughts?

.: Jan-Ivar :.

[1] Firefox has a camera-selector in the permission prompt, but we're 
finding it's no panacea for not having good defaults.
[2] Requesting multiple cameras is clearly out-of-scope, and I don't 
want to talk about that.