Output of decoding and encoding bytes are fingerprintable

[jonathanKingston]

Whilst playing around with the demo code on web.dev we noticed that the output of encoding is different based on the users machine.

I've not extensively tested this by any means however on different Mac machines with different hardware and the same version of Chrome the result was different.

Demo link: https://sand-freckle-pilot.glitch.me/

Example results from Mac machines:

• New canvas id checksum 7504035
• New frame id checksum 7502709

and:

• New canvas id checksum 7504035
• New frame id checksum 2040000

The differences observed should be outlined in privacy considerations.

[dalecurtis]

Have you run this test with WebRTC loopback? I would expect it shows the same issue.

[padenot]

Or even MediaRecorder from a source, and then HTMLVideoElement + <canvas> + drawImage really, might be simpler to construct a test-case this way for folks less familiar with WebRTC.

(I assume it's the same encoders/decoders underneath all of those APIs, this is the case in Gecko).

[chcunningham]

Triage note: marking 'editorial' for additions to privacy considerations.