Spec should document fingerprinting and XSLeak risk #42
Description
This review is part of the requested PING review.
The proposed functionality may increase fingerprinting risk and cross-site information flows, depending on how browsers make autoplay decisions.
If browsers make autoplay decisions based on any of following inputs (incomplete list), the new functionality contributes to fingerprinting risk:
- a profile/browser setting
- a global permission setting
- an OS level setting or feature (e.g., data saving, battery status)
- etc
If browsers make autoplay decisions based on any of the following inputs (incomplete list), the new functionality may create a new cross-site information flow.
- whether any media is playing (or has played) on anther page/tab
- whether the site has instances open on other pages (playing or otherwise)
These are important, privacy-relevant decisions and factors implementors will need to consider, and should be incorporated into the privacy considerations section.