W3C home > Mailing lists > Public > public-webrtc-logs@w3.org > January 2019

Re: [mediacapture-main] enumerateDevices can be used to track user devices in background pages (#561)

From: Jan-Ivar Bruaroey via GitHub <sysbot+gh@w3.org>
Date: Thu, 24 Jan 2019 23:54:51 +0000
To: public-webrtc-logs@w3.org
Message-ID: <issue_comment.created-457403182-1548374090-sysbot+gh@w3.org>
I ran a couple ideas in my head:

If, [on pageload](https://w3c.github.io/mediacapture-main/getusermedia.html#mediadevices), the document is not fully active and in focus, then instead of `null`:
 1. Initialize [[storedDeviceList]] to an empty list.
 2. Initialize [[storedDeviceList]] to a previous in-memory cached storedDeviceList for this origin, or `null` if not found.
 3. Initialize [[storedDeviceList]] to an empty list if origin is found in in-memory cached list, or null.
 4. Initialize [[storedDeviceList]] from a global in-memory storedDeviceList cache that holds back updates until tabs receive focus.
 5. Defer resolving enumerateDevices() promise until document becomes fully active and in focus.

(1) might break legitimate WebRTC sites, e.g. restoring Firefox with pinned tabs after a restart.
(2) would mitigate (1), but requires some work, and is vulnerable to `1.evil.com`, `2.evil.com`.
(3) is a cheaper (2) that's meaner to background tabs that fall in the net.
(4) probably is the full airtight solution, but again probably requires some work, and hard to spec.
(5) would be a simple solution that side-steps the problem, but might depend on https://github.com/w3c/mediacapture-main/issues/560.

-- 
GitHub Notification of comment by jan-ivar
Please view or discuss this issue at https://github.com/w3c/mediacapture-main/issues/561#issuecomment-457403182 using your GitHub account
Received on Thursday, 24 January 2019 23:54:53 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 4 June 2019 15:32:54 UTC