Re: [w3ctag/design-reviews] Cross-spec device identification & association (#64)

@travisleithead I'm sorry, I've been waiting for something more concrete in https://github.com/w3ctag/design-principles/issues/69 to review, but nothing has materialized so far.

Of the [two schools of thought](https://github.com/w3ctag/design-reviews/issues/64#issuecomment-305048626), the first one seems like a red herring, as having a super-cookie that works as an identifier across all domains seems like a bad idea, even behind a user-prompt.

The second school appears to tie the concept of origin-unique IDs, which are always a good idea IMHO, with the idea that these should be persisted by default.¹

That seems like a false choice to me. Instead, the options to consider here seem to be *opt-in* vs. *opt-out* vs. *always persisted* (I trust clearing cookies erases IDs regardless).

MediaCapture is an example of *implicit opt-in* in Firefox. That is, origin-unique [deviceId](https://w3c.github.io/mediacapture-main/getusermedia.html#dom-mediadeviceinfo-deviceid)s are only given to sites the end-user indicates an elevated level of trust with (e.g. sharing mic or camera). This critically leaves out the drive-by web.

There are normative requirements on browsers that forgo this:

*"[When permission is lacking]... the user agent MAY clear this identifier once the last browsing session from this origin has been closed. If the user agent chooses not to clear the identifier in this condition, then it MUST provide for the user to visibly inspect and delete the identifier, like a cookie."*

Specifically, the concern was creating a new class of persistent identifier without visibility.

Will the guidelines (about to be) given here, run afoul of this concern?

---
<sub>1. Or at least "to ***enable*** persistence by default", which is not the same thing as ***recommending*** it. Are we merely recommending origin-uniqueness here, in order to let browsers that so wish to persist by default, or are we recommending all browsers persist by default? I can't tell.</sub>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/64#issuecomment-327287213