3 ms·

> `credentialless` to load youtube in a blank disposable context, without access to the origin's network, cookies, and storage data. So it won't use my profile

> `credentialless` to load youtube in a blank disposable context, without access to the origin's network, cookies, and storage data. So it won't use my profile to load this ad-free with my subscription? Say what you want about premium subscriptions, but bypassing user preferences that mean they will see ads is not exactly a strong pushback against "enshittification". In fact, most of the details here are only harm reduction if you strongly believe that YouTube will do anything the browser can do to harm users. I see little evidence of this. Yes there are ads, I know people hate ads, I get that. But not allowing access to the camera? YouTube obviously isn't using the camera, what is that achieving? Pitching this as a generalised "hardened iframe" for untrusted content, sure! These are good things, and the allow spec should have a deny-all. But there's a lot of FUD in this with little to back it up for the case of YouTube, at least in my experience as a heavy user of the platform.

animuchan 3y ago
> YouTube obviously isn't using the camera, what is that achieving? Without auditing YT's code, it's not very obvious to me. But let's assume it doesn't; if/when it gets hacked, the injected malicious code might still want to use the camera.
dspillett 3y ago
> So it won't use my profile to load this ad-free with my subscription? Embedded players do not (currently) show adds, so no one would be losing that nicety using this method.
- danpalmer 3y ago
  Fair point! I had thought I had seen ads in embedded players, but it might just have been spammy looking video thumbnails or something. Another commenter points out it also means no watch-later, which is perhaps a more concrete example of the same problem – being logged out is a worse experience here for many.
- sorenjan 3y ago
  I've seen ads in embedded Youtube videos. https://support.google.com/youtube/answer/132596?hl=en https://support.google.com/youtube/answer/132596?hl=en
bogwog 3y ago
> So it won't use my profile to load this ad-free with my subscription? Say what you want about premium subscriptions, but bypassing user preferences that mean they will see ads is not exactly a strong pushback against "enshittification". Why aren't you using an adblocker? Even if you pay for youtube premium, the rest of the internet will still be inundated with ads. As an independent publisher of a site, I would care more about protecting my users' privacy than protecting youtube's business model. > But not allowing access to the camera? YouTube obviously isn't using the camera, what is that achieving? As the article says, you need to disallow every single permission individually because the spec has no "deny all" option. That's why there's also accelerometer, gamepad, payment, etc permissions in there.
- danpalmer 3y ago
  > As the article says, you need to disallow every single permission individually because the spec has no "deny all" option Yes, and I agree that a deny-all option makes sense in general, but my point is that denying YouTube access to the camera seems nonsensical. It betrays a bad-faith viewpoint that is in my opinion, one not based in evidence or experience. What is the threat model? I can't see one that makes sense in the context of YouTube being a large consumer product oriented company.
  - animuchan 3y ago
    [Principle of least privilege][1] is widely accepted to be a good practice, so I'm not sure about the bad faith argument. In the same way my apartment door is locked because it's the safe default, and not because my neighbors are known to be criminals. [1]: https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege
dspillett 3y ago
> But not allowing access to the camera? YouTube obviously isn't using the camera, what is that achieving? Isn't it? How do you know for sure? It definitely isn't if you don't explicitly let it. One possible use is browser fingerprinting and other such profiling. At a minimum the existence of a camera or not provides one bit of information for a fingerprinting data pool. I don't know if the relevant interface provides further information (camera capabilities like resolution, for instance), if it does then that would be useful for this purpose too.
- krisoft 3y ago
  > How do you know for sure? Because my browser is not asking permission to access the camera? Sure enough the browser is made by the same company, but if you don't trust that how do you trust these permission flags? (Since they are also carried out, or not by the browser)
  - dspillett 3y ago
    > Because my browser is not asking permission to access the camera? IIRC (I've not verified, so I may not RC!) you can see the presence of a camera (or permission to see one) without doing anything that will prompt the permission prompt. > the browser is made by the same company Chrome does not have 100% marketshare. Your browser might be made by the same company, the next person's may not be.
    - krisoft 3y ago
      > Chrome does not have 100% marketshare. Your browser might be made by the same company, the next person's may not be. But you feel that that makes the argument for the flags even weaker? I choose to talk about Chrome because that is where the supposed argument can be the strongest (and they are still weak).
  - Wowfunhappy 3y ago
    What if something else on the page is (legitimately) using the camera?
tantalor 3y ago
Also, with no profile you can't save to "watch later" list.
- dspillett 3y ago
  Something in the options block the “view in youtube” links in the interface too, I thought it would but just checked to confirm, so you can't note it for future viewing that way either. I'd suggest the best way to manage this is to provide your own “view directly in youtube” link with the embedded video, perhaps underneath, so your users get the embedded video minimal cruft by default but get the option of the fuller features if they have a youtube account and want to use things like adding to playlists.

animuchan 3y ago

> YouTube obviously isn't using the camera, what is that achieving? Without auditing YT's code, it's not very obvious to me. But let's assume it doesn't; if/when it gets hacked, the injected malicious code might still want to use the camera.

dspillett 3y ago

> So it won't use my profile to load this ad-free with my subscription? Embedded players do not (currently) show adds, so no one would be losing that nicety using this method.

danpalmer 3y ago
Fair point! I had thought I had seen ads in embedded players, but it might just have been spammy looking video thumbnails or something. Another commenter points out it also means no watch-later, which is perhaps a more concrete example of the same problem – being logged out is a worse experience here for many.
sorenjan 3y ago
I've seen ads in embedded Youtube videos. https://support.google.com/youtube/answer/132596?hl=en https://support.google.com/youtube/answer/132596?hl=en

bogwog 3y ago

> So it won't use my profile to load this ad-free with my subscription? Say what you want about premium subscriptions, but bypassing user preferences that mean they will see ads is not exactly a strong pushback against "enshittification". Why aren't you using an adblocker? Even if you pay for youtube premium, the rest of the internet will still be inundated with ads. As an independent publisher of a site, I would care more about protecting my users' privacy than protecting youtube's business model. > But not allowing access to the camera? YouTube obviously isn't using the camera, what is that achieving? As the article says, you need to disallow every single permission individually because the spec has no "deny all" option. That's why there's also accelerometer, gamepad, payment, etc permissions in there.

danpalmer 3y ago
> As the article says, you need to disallow every single permission individually because the spec has no "deny all" option Yes, and I agree that a deny-all option makes sense in general, but my point is that denying YouTube access to the camera seems nonsensical. It betrays a bad-faith viewpoint that is in my opinion, one not based in evidence or experience. What is the threat model? I can't see one that makes sense in the context of YouTube being a large consumer product oriented company.
- animuchan 3y ago
  [Principle of least privilege][1] is widely accepted to be a good practice, so I'm not sure about the bad faith argument. In the same way my apartment door is locked because it's the safe default, and not because my neighbors are known to be criminals. [1]: https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege

dspillett 3y ago

> But not allowing access to the camera? YouTube obviously isn't using the camera, what is that achieving? Isn't it? How do you know for sure? It definitely isn't if you don't explicitly let it. One possible use is browser fingerprinting and other such profiling. At a minimum the existence of a camera or not provides one bit of information for a fingerprinting data pool. I don't know if the relevant interface provides further information (camera capabilities like resolution, for instance), if it does then that would be useful for this purpose too.

krisoft 3y ago
> How do you know for sure? Because my browser is not asking permission to access the camera? Sure enough the browser is made by the same company, but if you don't trust that how do you trust these permission flags? (Since they are also carried out, or not by the browser)
- dspillett 3y ago
  > Because my browser is not asking permission to access the camera? IIRC (I've not verified, so I may not RC!) you can see the presence of a camera (or permission to see one) without doing anything that will prompt the permission prompt. > the browser is made by the same company Chrome does not have 100% marketshare. Your browser might be made by the same company, the next person's may not be.
  - krisoft 3y ago
    > Chrome does not have 100% marketshare. Your browser might be made by the same company, the next person's may not be. But you feel that that makes the argument for the flags even weaker? I choose to talk about Chrome because that is where the supposed argument can be the strongest (and they are still weak).
- Wowfunhappy 3y ago
  What if something else on the page is (legitimately) using the camera?

tantalor 3y ago

Also, with no profile you can't save to "watch later" list.

dspillett 3y ago
Something in the options block the “view in youtube” links in the interface too, I thought it would but just checked to confirm, so you can't note it for future viewing that way either. I'd suggest the best way to manage this is to provide your own “view directly in youtube” link with the embedded video, perhaps underneath, so your users get the embedded video minimal cruft by default but get the option of the fuller features if they have a youtube account and want to use things like adding to playlists.