Re: [w3c/permissions] Provide guidelines or heuristics to prevent fingerprinting in case permission is denied (Issue #361)

eladalon1983 left a comment (w3c/permissions#361)

In practice, websites tend to shy away from heavy-handed fingerprinting mechanisms that might alarm the users, or uncalled for prompts that could aggravate the user to the point of leaving the site.

Asking the user for permission to access the camera, microphone or screen-sharing all appear to me like things that would top the list for the suspicion they would foster in the user.

It might be that sites could derive some information from querying for the user's past interaction with other sites, but that seems mostly theoretical, and imho, extremely unlikely given the cost-benefit analysis.
- From the **benefit** side, consider that it's not a lot of users that would have interacted with a collaborating other site in a meaningful way that can provide any information. (True that `block`'s signal is strong precisely because of its rarity. See more on cost, though.)
- From the **cost** side, consider that websites would have to set up a collaboration with a reputable-enough site that the user might have reasonably had previous interaction with that site. Consider that this would come at a cost to load times, and that this cost would be incurred repeatedly and only yield a benefit rarely. I find it hard to believe that fingerprinting libraries would use this rare, costly signal.

(But, of course, I might have missed the point.)

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/permissions/issues/361#issuecomment-3004103626
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/permissions/issues/361/3004103626@github.com>