renderSizeHint fingerprinting concerns with "hardware" hint

[mjwilson-google]

There is concern from Chrome Privacy that the "hardware" hint presents a drive-by fingerprinting risk, by exposing information about the user's default audio hardware buffer size.

Proposed mitigation:

• Do not allow reading the actual value until the AudioContext transitions to "running" (potentially returning 0 in the meantime)
• Reject "hardware" hint if the microphone permission is not granted

I think it may also be better to move retrieving the "hardware" buffer size to a different API that can be called (with appropriate privacy mitigation) before the AudioContext is constructed. This would also simplify the AudioContextOptions and OfflineAudioContextOptions: renderSizeHint could be a simple number similar to sample rate.

[mjwilson-google]

Notes from Audio WG meeting 2025-01-08

• "hardware" was added mostly for Android mobile devices where it can have a significant performance benefit, more context here: Allow user-selectable render quantum size #2450
• Another possible mitigation is to only return a pre-defined render quantum size based on the sample rate and platform
• WG would like to discuss further before specifying a mitigation

[mjwilson-google]

Notes from Audio WG meeting 2026-03-12

• The first mitigation (return 0 until transitioning to running) is necessary to prevent drive-by fingerprinting, and similar to how latency values are not populated until at least one callback has run so shouldn't be too confusing to developers
• Once we have a running AudioContext it's possible to recover the hardware buffer size with AudioWorklet, so there is probably no privacy benefit to putting just the "hardware" hint behind a permission
• SpeakerSelection API may be a good place to put APIs for getting hardware information, but that will take more time and we want to have hardware hint available now.

So the plan to fix this is:

• Specify the first mitigation (return 0 until AudioContext transitions to running)
• Add more text to the privacy section, near the SampleRate discussion