Re: Comments/Questions on Media Capture Streams – Privacy and Security Considerations

On Friday 23 October 2015 16:29:42 Eric Rescorla wrote:
> In fact the RTCWEB Security Architecture documents used to require that
> the site opt-in to persistent permissions and there was strong consensus
> to remove that requirement precisely because browsers weren't interested
> in implementing it.

We are repeating the geolocation experience where (mostly US-policy inspired) 
browsers were saying that they would only implement a one time a permission 
request to use your location and they would never ask again. 

My remark that the European Law here requires a permanent beacon to be shown 
as long as one is located was met with rather violent opposition and the 
requirement didn't make it into the Specification. But at the end of the day, 
everybody implemented the constant beacon as they wanted to ship in Europe.  

I predict that if browsers do one time requests on WebRTC and it isn't a legal 
requirement yet in Europe to easily revoke it, it will become a legal 
requirement quickly. And this legal requirement will certainly be worse than 
doing it right in the first place. So while there may be an interest to 
benefit from the weak protections in some intermediate time, the refusal to 
implement will not be sustainable on the long run. It actually adds to the 
transatlantic unease. What is the gain to justify such important tradeoffs?

 --Rigo