[Webkit-unassigned] [Bug 191112] New: [MediaStream] Don't reveal device IDs until the user has granted permission to capture

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=191112

            Bug ID: 191112
           Summary: [MediaStream] Don't reveal device IDs until the user
                    has granted permission to capture
           Product: WebKit
           Version: Other
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebRTC
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: eric.carlson at apple.com
                CC: youennf at gmail.com

WebKit currently regenerates device IDs when a page is refreshed, unless the user has granted permission to capture without a prompt. This was done to enhance user privacy because we observed that many sites that don't ever call getUserMedia call enumerateDevices for fingerprinting. This behavior is different from other browsers, which return somewhat stable device IDs, causes problems for existing scripts (e.g. see bug 179220), and makes device IDs essentially useless.

To improve the usefulness of device IDs to scripts, while not increasing the usefulness for fingerprinting, enumerateDevices should return stable device IDs once the user has granted permission to capture and return an empty string before that.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20181031/439702c0/attachment.html>