W3C home > Mailing lists > Public > public-webrtc-logs@w3.org > January 2019

Re: [mediacapture-main] Spec does no handle fingerprinting related to exposing non default capture devices (#559)

From: Jan-Ivar Bruaroey via GitHub <sysbot+gh@w3.org>
Date: Wed, 23 Jan 2019 13:54:21 +0000
To: public-webrtc-logs@w3.org
Message-ID: <issue_comment.created-456809187-1548251659-sysbot+gh@w3.org>
> I guess such a USB device API would raise similar concerns on our side.

The use-case is: "Sorry, you have no camera". User plugs in camera. "Oh, now you're good".

This is also detectable by calling *getUserMedia* repeatedly.

> we would not like to have web pages being able to know that some keys were pressed before the page got focus.

Again, *enumerateDevices()* and *devicechange* require focus for the drive-by-web.

> That specific example is not working in Safari though. Some more complex ones might.

Right, the order in which constraints must be parsed is not mandated. Whatever the order Safari uses, can be exploited to leak just as much information.

> the spec could call out some of these issues 

*"This error gives information about what the underlying device is not capable of producing, before the user has given any authorization to any device, and can thus be used as a fingerprinting surface.*
![fingerprint](https://w3c.github.io/mediacapture-main/images/fingerprint.png)"

-- 
GitHub Notification of comment by jan-ivar
Please view or discuss this issue at https://github.com/w3c/mediacapture-main/issues/559#issuecomment-456809187 using your GitHub account
Received on Wednesday, 23 January 2019 13:54:22 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 4 June 2019 15:32:54 UTC