Privacy evaluation

[youennf]

This is a general issue about evaluating the privacy risks this new API can bring to existing infrastructure and adding a privacy section to the proposal.

This API may provide access to encoder/decoder states otherwise not available to applications, for instance timing information. It would be good to investigate this potential issue and the potential mitigations.
For instance, a fully native pipeline probably does not bring much fingerprinting, or makes it more easy to add mitigations. Limiting what JS can do/observe is a potential mitigation.

[alvestrand]

For non-timing information, the API will provide exactly the same information to JS as that passed across the network in an unprocessed stream - so that's nothing new.
Timing information is trickier to evaluate (as usual).

[youennf]

For non-timing information, the API will provide exactly the same information to JS as that passed across the network in an unprocessed stream - so that's nothing new.

This API might make it much cheaper and faster to harvest the fingerprinting information.
Having to setup a separate network node, doing negotiation, sending packets and so on is costly to operate, is potentially harming the user's bandwidth and is potentially slow to get results.

It would be interesting to study what this API would leak compared to what a pair of local loop peer connections is leaking.

Timing information is trickier to evaluate (as usual).

Agreed this is the one to be evaluated with greatest care.

[alvestrand]

I started on a privacy section in #22 - please comment!
Note that you won't get this API without setting up a connection, doing negotation and sending packets and so on - you can do all this locally, of course.

[alvestrand]

Since #22 is merged, and there are no more comments, I'm closing this.

[youennf]

I am not sure we should close it yet.
Spec currently says: "The API will allow access to some aspects of timing information that are otherwise unavailable, which allows some fingerprinting surface."
We should either explain why this is ok or provide guidelines on how to mitigate this.