W3C home > Mailing lists > Public > public-device-apis@w3.org > August 2012

Re: Networked Service Discovery and Messaging - first draft published

From: Rich Tibbett <richt@opera.com>
Date: Fri, 3 Aug 2012 20:00:12 +0200
Message-Id: <95967DC5-BEE6-490F-B12A-5B374B7AD2D0@opera.com>
To: "public-device-apis@w3.org" <public-device-apis@w3.org>
Hi Harald,

On Aug 3, 2012, at 6:38 PM, Harald Alvestrand <harald@alvestrand.no> wrote:

> Just because I can't find it in the draft:
> 
> What's the security considerations of this document, and where are they documented?

Security in the form of user authorisation opt-in is included directly in the algorithm for getNetworkServices (specifically, Step 11 in http://w3c-test.org/dap/discovery-api/#dom-navigator-getnetworkservices). An implementation will not conform to the specification if they do not implement the normative requirements included here.

> In particular, are there any security implications of letting JavaScript applications run mDNS or uPNP queries on the browser's local network, and are there elements of the network topology information that should be considered sensitive?

These are existing and wide-spread technologies in use today. In theory any application can connect to these services already in native code. If there are security implications in accessing services on the local network then they are handled by the devices themselves (with e.g. HTTP authentication, TLS, Cookies or some other mechanism). This is the standard security for URLs and is documented particularly well in e.g. the Web Sockets protocol [1].

Users also have to opt-in to sharing services with a web page. In terms of the UI we have also previously presented some UI ideas [2] but these are by no means normative.

I'm not a huge fan of Individual Security and Privacy Consideration sections in specs. It's Important to tackle these things by design and include security as part of the defined algorithms. Having said that, if the group thinks this is a good idea then we can add something along those lines.

Thanks, 

Rich

[1] http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-17#section-10.5

[2] http://people.opera.com/richt/release/specs/discovery/tpac2011_servicediscovery_ui_1.png
     http://people.opera.com/richt/release/specs/discovery/tpac2011_servicediscovery_ui_2.png
Received on Friday, 3 August 2012 18:00:41 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Friday, 3 August 2012 18:00:41 GMT