Additional protection against automatic camera capture (was: [Bug 25809] Security issue: Abuse of "call me" URLs)

• From: Dominique Hazael-Massieux <dom@w3.org>
• Date: Mon, 15 Sep 2014 17:32:43 +0200
• To: public-media-capture@w3.org
• Message-ID: <1410795163.3843.16.camel@cumulustier>

A couple of weeks ago, discussing bug 25809 (“call me” URLs), I
suggested some potential additions to the spec to make it harder to trap
users in getting automatically and unexpectedly “on air”:
* requiring an engagement gesture for getUserMedia
* linking permanent permissions to the embedded stack of origins
* letting pages opt-in to allow their embedded frames to make use of
getUserMedia

There was support from some, and hesitations from others.

To move forward with this, we could:
* ask the chairs to call for consensus on this now
* ask for further input from the Web Apps Security WG and/or the TAG
* leave the spec as is, with a note asking for input from readers on
these questions

Thoughts?

Dom

Received on Monday, 15 September 2014 15:33:05 UTC