Add security-privacy-questionnaire.md #242
Conversation
|
@jan-ivar : PTAL |
security-privacy-questionnaire.md
Outdated
| ### 06. What information from the underlying platform, e.g. configuration data, is exposed by this specification to an origin? | ||
| No particular additional information is exposed about the camera hardware, like brand, etc, however we do expose if the platform has support for the constainable properties. | ||
| No particular additional information is exposed about the camera hardware, like brand, etc, however we do expose if the platform has support for the constainable properties. |
There was a problem hiding this comment.
I would add:
"A site with permission to one or more cameras will be able to probe the existence of these new capabilities on those cameras, by passing constraints to getUserMedia or track.applyConstraints. The new capabilities are:" (and then list them).
Also:
"A site without camera permission may be able to probe the lack of a capability from the user's total set of cameras, but by doing so risks causing a user-facing prompt if the capability is available. This helps provide browsers with information about a site's camera needs when prompting the user, while deterring tracking libraries from attempting to use the API without detection."
About pan-tilt-zoom permission: if I'm reading the spec right, the mere mention of pan, tilt or zoom in a constraints-set should trigger a prompt for pan-tilt-zoom permission, even if it ends up finding zero devices, is that correct? Is that how it's implemented in Chrome or other browsers? If so, then there's no added pre-prompt exposure from those three properties, otherwise there would be.
There was a problem hiding this comment.
Chrome does not request a pan-tilt-zoom camera permission (but only a normal camera permission) if there are no pan-tilt-zoom cameras.
There was a problem hiding this comment.
Isn't track.applyConstraints an overly complex method to probe existence of capabilities when there are track.getCapabilities and track.getSettings for exacly that kind of probing?
|
@eehakkin , @beaufortfrancois and @jan-ivar : I am merging the first draft of this questionnaire as we need to discuss this in the WebRTC - editors meeting. We can correct / append this in the coming days. |
Fixes #172