Re: [mediacapture-main] fixed, per origin, device ID creates tracking risk (#607)

> @guidou
> 
> > @snyderp Once permission is given, pages can use the label field to do the tracking, regardless of device IDs.
> 
> But these will not be unique to a client though, no? Would be ideal to not have the site ever learn the label ether, just the handle to refer to it with further, but as long as the site learn the label _after_ permission is granted, and the label is not unique to the client, then I'm far less concerned.

In Chromium, the labels are the same for all domains (provided it's the same devices) and (together with a cookie) are probably as good for tracking as device IDs .

> 
> > 1. If the embedded iframe is in the same domain, yes. If it's a cross-domain iframe, no.
> 
> What happens when the same 3p frame (i.e. third-party.com) appears in two different 1p domains? (i.e. are we still in a single key'ed world, or a now a double key'ed world)?
> 
In Chromium it is single keyed. The device IDs are the same for third-party.com in both cases and are different from the IDs seen by 1p. If permissions are given, the labels are the same everywhere.


-- 
GitHub Notification of comment by guidou
Please view or discuss this issue at https://github.com/w3c/mediacapture-main/issues/607#issuecomment-524979393 using your GitHub account

Received on Monday, 26 August 2019 18:42:28 UTC