1812190 - Discuss if Autoplay Policy Detection API should be affected by resisting finger printing

Status: NEW

(Core :: Audio/Video: Playback, task, P3)

Description

[Alastor Wu [:alwu][PTO 5/15-5/18]]

In this bug, I would like to discuss if we should restrict Autoplay Policy API if privacy.resistFingerprinting=true.

Comment 1

[Thorin [:thorin]]

IIUIC, we could allow the API but enforce autoplay settings to something, also because it's exposed in UI settings and we can do with tightening up RFP variables, and also because it is already exposed without the API (pretty sure this is the case but costly, did not PoC)

Links

• Firefox Autoplay Policy Documentation [PDF] - https://drive.google.com/file/d/1Lkk37Vq8YhURxPL7UBVy0CuuZJU62PYQ/view
• https://w3c.github.io/autoplay/#security-and-privacy - but there is entropy, amiright?
  • edit see https://github.com/w3c/autoplay/issues/24

perhaps

• media.autoplay.default = 5 // block all by default
• media.autoplay.blocking_policy = 2 // click to play for each and every media
• ignore exceptions (similar to how RFP ignores zoom)

This would then propagate to the API, and all RFP users would look the same, right?

Comment 2

[Thorin [:thorin]]

https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41692