Media devices enumeration

Kinds and counts come back with no prompt, and only the names wait for one. The set describes the computer rather than the profile, so every profile opened on one machine returns the same set.

Media devices enumeration is the list of microphones, speakers and cameras a browser hands a page before any permission.

What comes back without a prompt

One call returns an entry for every input and output the machine has. The interesting part is not what each entry says but how many of them there are.

The kind of every device
Microphone, speaker or camera, one entry each, in the order the system keeps them.
How many of each
The counts are the part that describes the machine, and they need no permission at all.
Empty names and empty identifiers
Labels stay blank until a page has been allowed to record something, and the counts do not wait for that.

Why the set links profiles

A laptop with one microphone, two outputs and one camera answers the same way in every profile ever opened on it.

Accounts that never shared an address, a cookie or a password are joined by an inventory that was never meant to identify anything.

It is also a cheap check to run. A site reads the set once on the first page and stores three small numbers.

What our engine does

The counts are drawn from the profile seed, so one profile keeps its own set and two profiles differ from each other.

The list a page receives is a subset of what the machine really holds, cut at the moment the page asks for it.

1
The seed names a count per kind
It is derived from the profile identifier, so it is the same on every launch of that profile.
2
The browser keeps that many
Entries beyond the count are left out of the reply, and the rest go through untouched.
3
The self-test reads it back
Inside a profile the fingerprint self-test asks for the list and holds the counts against the profile.

What cannot be invented

A device identifier is derived by the browser from the site and from the real device, so a made up one would be the mark rather than the cure.

So the set can only be shortened and never lengthened, and that is written here rather than left for you to discover.

No kind is emptied out
A browser that answered with no camera on a machine that has one would hand the camera over on the very next question, and two replies in a row that disagree are louder than any count.
A machine without a camera keeps none
Nothing is ever added, so a computer with no camera answers none, exactly as it should.

Speech voices travel with this

The list of speech voices is the same kind of inventory. It is read in one line, it needs no permission, and it belongs to the operating system rather than to the browser.

A profile claiming one system while answering with another system's voices contradicts itself, so voices are kept to the language the profile declares.

Often confused with

The camera prompt
Asking to record is a separate step. Counting is done before it and does not depend on the answer.
A WebRTC leak
That is about the addresses a connection reveals. This is about the hardware inventory, and the two are measured apart.
Device memory
Another machine level reading drawn from the profile seed, and a term with a page of its own.

What this does not do

It does not add a device that is not there. A profile asking for more cameras than the machine holds gets the machine's number, because the list is only ever cut.
It does not empty a kind out. A browser answering that there is no microphone while handing one over on the next call would be its own signal.
It does not rewrite the names. Labels arrive from the system after permission is given, and they describe the real hardware.
It does not carry a phone profile all the way. On our own engine such a profile still lists audio outputs, and a browser on a real handset lists none.

Check it

Every claim above comes from a file you can open.

Where the counts are drawn from the profile seed: packages/shared/src/index.js
The rule the engine applies to the list: engine/patches/armanos-fp-0012.diff
The device check the self-test runs: apps/desktop/src/lib/fpAudit.js
What the shipping build answered for devices and voices: engine/приёмка-отчёт.json

Questions

Does a site need permission to count my devices?: No. Kinds and counts come back on the first ask, and the prompt you know belongs to recording rather than to counting.
Do the device names come through too?: Not before permission. Until a page has been allowed to record, the labels and identifiers are empty strings.
Does plugging in headphones change the answer?: The machine's list grows, and the profile still shows no more entries than its own number allows.
Is a virtual microphone a good idea?: It adds an entry that most machines do not have, so it moves you towards a rarer set rather than a more ordinary one.
How do I see mine?: The self-test inside a profile reads the list and compares the counts with the profile. It is one of the 29 measurements that run there.

Next to this

See what your own profile lists

The fingerprint self-test runs inside a profile and shows all 29 measurements, green and red alike.

Download ARMANOS Our browser engine