Juiced-up canvas fingerprinting

[martinthomson]

A video of an element provides more information to a fingerprinter than canvas snapshots. In addition to the usual font and graphic handling variations, the video will capture animation quirks.

This needs to be at least acknowledged. Browsers that restrict canvas read-back might want to apply similar protections here also, but it would be very much harder.

[eladalon1983]

To gain access to the Element Capture API, an application must first gain "video-access" to the entire tab. By then, any font-based fingerprinting attack is trivial and unstoppable. (Please correct me if I'm wrong.)

It might be worth acknowledging this in the spec, but in that case, it's probably to be acknowledged in getDisplayMedia's and getViewportMedia's own specs, and not in downstream specs such as this one.