RE: deviceId and fingerprinting (or user tracking)

Re> Can you clarify what you mean by "system" in this case?

I meant a user device.

Re> "re-randomize deviceId when cookies are cleared"

Thanks folks for the clarification.  That is the info I’m looking for.  And, yes, it’d be great to add this to the spec.

-Shijun

From: Harald Alvestrand [mailto:harald@alvestrand.no]
Sent: Friday, September 26, 2014 1:26 AM
To: public-media-capture@w3.org
Subject: Re: deviceId and fingerprinting (or user tracking)

On 09/25/2014 06:21 PM, Shijun Sun wrote:

Folks,



I expect there is a consensus already in the WG on the topic.  I'd like to get some help to understand the mitigation mainly from the UA implementation perspective.



The deviceId is currently defined as an identifier which must be *persistent* between application sessions.  So a website can get the same deviceId's when a user visits the website using the same system, calling gUM() or not.  Should we expect the deviceId's for any specific website be (largely) consistent across all systems?  Otherwise, in the worst case when the Id is unique to each system, the website can potentially track the user.

Can you clarify what you mean by "system" in this case? Web pages of the same origin?
If they have the same origin, they should see the same deviceId; if they have different origins, they should see different deviceIds.

Spec text:

"Devices have an identifier which must be unique to the application (un-guessable by another application) and persistent between application sessions (e.g., the identifier for a given source device/application must stay the same, but not be guessable by another application)."

Yes, a web site that can already track the user using cookies can already track the user, so there is no additional attack that we need to defend against by changing deviceId.

Yes, "re-randomize deviceId when cookies are cleared" was agreed to, and needs to be added to the spec. It's already implemented in Chrome, I believe.

Note to editors: The term "application" needs to be defined in the document, with the explanation that all pages of an application have the same origin.








Appreciate any comment!



Best, Shijun