Figure out how much fingerprinting is needed/acceptable about web-bluetooth

[jyasskin]

Per the 2014-08-15 meeting, we should obscure as much of this as possible, in order to force devices to put effort toward making themselves fingerprintable if they want to do so.

The basic idea will be to require that each of these IDs be randomly selected per website/device pair. There's probably wording in some other standard we can borrow to specify it.

[dominiccooney]

This is framed as a tradeoff between utility of the API and the amount of obfuscation. The key question is, is there a region where utility is acceptably high, while malicious fingerprinting is impractical?

I doubt this.

I think you should focus on access to the device (the "explicitly pair each device" part) and not obfuscation. The access control policy is essential anyway. You can evolve it more easily than a set of obfuscations. It avoids the complexity of obfuscation in implementations.

[jyasskin]

Some background reading: http://www.chromium.org/Home/chromium-security/client-identification-mechanisms