Consider predictability of temporary identifiers (section 2.12)

[Perdu]

As I've worked on temporary identifiers during my thesis, I see two points that should be taken into consideration for section 2.12 ("What temporary identifiers might this this specification create or expose to the web?"):

• a temporary identifier which changes predictably does not provide sufficient privacy guarantees. For instance, when a Wi-Fi-enabled device emits probe request frames on a regular frequency containing a sequence number incremented with a predictable scheme (typically +1 or -1 on each frame), an attacker may easily predict following sequence numbers and thus break the anonymity of device brought by MAC address randomization. While the Gamepad API example does not violates this in itself, I think it may lead one to think that a simple incrementing counter is sufficient to provide privacy.

• It should be made sure that temporary identifiers are generated without statistical biais. This is once again a problem I encountered while studying MAC address randomization, as some chips failed to provide a good level of randomness for temporary MAC addresses, leading addresses to be reused by the same device. These "bad randomness addresses" thus constituted a potential identifier to detect the same device in the future.

I suggest adding these two points regarding predictability of temporary identifiers to the 2.12 section.