Apply privacy and security mitigations used by the Web Translation API to the Web Speech API

[evanbliu]

Chrome is planning on implementing the same privacy and security measures used by the Web Translation API, which uses on-device language packs for translations, to the Web Speech API.

We should consider adding these mitigations to the Web Speech API spec as well: webmachinelearning/writing-assistance-apis#47

TL;DR: Websites must call install() before they can use the on-device speech recognition language packs to prevent fingerprinting.

[evanbliu]

@padenot - What do you think of this proposal?

[youennf]

I think it is indeed worth doing a review in that area and beefing up the spec.
The addition of processLocally=true for instance is a potential fingerprinting vector when used with the available method.

Ditto potentially for the combo processLocally=true and start(MediaStreamTrack), though start may be gated by some kind of prompt according section 3.

It would be good to clarify how to get explicit user consent in the case of start(MediaStreamTrack) since it is not piggy backing anymore on microphone permission. Is there a need for a specific speech recognition permission policy?