Fingerprinting risk: users that configure their device to not permit screen locking #260
Description
Reviewer from Privacy WG here 👋
When applying an orientation lock in step 5.4, "if the attempt fails due to previously-established user preference, or platform limitation, or any other reason: [...] reject and nullify the current lock promise of document with a "NotSupportedError".". This leaves the user configuration potentially fingerprintble. This may be the correct behavior, but it would be nice to include a fingerprinting risk in the note associated with the step.
It also may be mitigated significantly by making the suggestion in Section 9 mandatory behavior: "A user agent SHOULD restrict the use of lock() to simple fullscreen documents as a pre-lock condition. [fullscreen]". Does anything prevent this from being MUST?