Re: [w3ctag/design-reviews] EME Extension: HDCP Policy Check (#323)

Note: also not a full review.

This proposal involves a privacy/performance tradeoff that I'm concerned with.

The performance benefit of having a way to do an upfront HDCP policy check is that sites which use EME can know whether or not, and what level of, HDCP playback is available before loading any media. This performance benefit is real, but fairly small.

The existing way to check for HDCP requires a successful key exchange, which means that only sites trusted by the CDM can query this. The proposed API can be called by sites that are not trusted by the CDM. Thus, the privacy cost is that a much larger set of sites would now have access to approximately four bits of fingerprinting.

Have you considered [PING's security and privacy questionnaire](https://w3ctag.github.io/security-questionnaire/)? I think question 4.6 is particularly relevant: https://w3ctag.github.io/security-questionnaire/#underlying-platform-data

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/323#issuecomment-456599523