Privacy Considerations: Preventing information leakage and fingerprinting

[johannhof]

We should give guidance that the API should avoid leaking any user or device information beyond what is specifically requested by the site, after the user grants permission. Proposed features like #219 can be designed in a way that exposes device information through revealing supported protocols. User-specific information could be revealed e.g. through delayed promise resolution for installed wallet applications vs. instant promise rejection for non-installed wallets.

[simoneonofri]

I think the rules defined in Mitigating Browser Fingerprinting in Web Specifications can be applied.