-
Notifications
You must be signed in to change notification settings - Fork 47
id field in gamepad might have a persistent identifier? #73
Copy link
Copy link
Open
Labels
CR Blockerprivacy-trackerGroup bringing to attention of Privacy, or tracked by the Privacy Group but not needing response.Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response.security-trackerGroup bringing to attention of security, or tracked by the security Group but not needing response.Group bringing to attention of security, or tracked by the security Group but not needing response.wide review
Description
Metadata
Metadata
Assignees
Labels
CR Blockerprivacy-trackerGroup bringing to attention of Privacy, or tracked by the Privacy Group but not needing response.Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response.security-trackerGroup bringing to attention of security, or tracked by the security Group but not needing response.Group bringing to attention of security, or tracked by the security Group but not needing response.wide review
Type
Fields
Give feedbackNo fields configured for issues without a type.
(See also the email thread)
I have read in the past that the id field sometimes contains things like a serial number. Obviously this presents a very persistent tracking identifier.
Mozilla says: in Firefox it will contain three pieces of information separated by dashes (-):
Two 4-digit hexadecimal strings containing the USB vendor and product id of the controller
The name of the controller as provided by the driver. https://developer.mozilla.org/en-US/docs/Web/API/Gamepad/id
How is this exposed in other browsers? It seems like it would be advantageous to require this string to not contain uniquely identifying information and to Non-normatively suggest an algorithm to do so.
Florian suggest that we standardize the id attribute so the vendor and device id are in a consistent format and order.
He also indicated that the product name is displayed to the user to help them identify the control (they won't know vendor/device id of course.)
My concern is still that the product name may contain serial numbers or something similar that would uniquely identify a particular controller vs merely identifying it as that type of controller. Have other people seen this behavior? It seems it would be near-impossible to fix on the controller side (since it'd require controllers to be reflashed with new firmware...)