[Privacy] Clarify steps to generate callbackId

[markafoltz]

https://lists.w3.org/Archives/Public/public-privacy/2017JanMar/0009.html

2. It is unclear if the callbackId is derived from a unique identifier on the Callback device (e.g. a hash value of a MAC address). Is there any reason why this could not be generated for each session by the UA? It would still be unique across all callback devices on the network but different devices on the same network could have a different set of unique devices and thus reducing the potential for device fingerprinting.

I think the spec is clear that it's unique to the media element. Should an algorithm be defined to generate it?

[avayvod]

I'm not even sure what a "callback device" is in the question.

A callback is basically a Javascript function that can be called by the user agent. A numeric identifier is needed to be able to unregister the callback for cleanup. In Chrome we just find the next integer that's not assigned to any previously registered callback that hasn't been cancelled yet. I'd be wary putting this into an algorithm as it may restrict other user agents in their implementation and worse make web pages depend on the order of ids or something.

We can add a note that the identifier MUST not leak any privacy information, however I doubt that's very helpful.

[markafoltz]

My reading was that "Callback device" is the device triggering the callback, e.g. a newly discovered remote playback device.

[markafoltz]

I think a note clarifying the id generation mechanism would address this concern. I can propose a PR.

[avayvod]

The id is returned way before any device is found (at least in the simple use case when availability starts as a result of watchAvailability). When the device is found, the callback is fired with a single boolean argument and its id doesn't change.
Clarifying the id generation would probably help eliminate confusion though I agree.

[avayvod]

As a follow up on the PR #83, we might want to spec the uniqueness of the id (e.g. within a frame) so that web authors could rely on the behavior suggested by the example.

[markafoltz]

Closing as I believe this is addressed by the PR.