[deviceorientation] Security and privacy section must be normative

alexshalamov has just created a new issue for https://github.com/w3c/deviceorientation:

== Security and privacy section must be normative ==
[Security & Privacy section](http://w3c.github.io/deviceorientation/spec-source-orientation.html#security-and-privacy) must be made normative to avoid interoperability issues related to cross-origin API access, exposure of powerful features only to secure context, etc.

Currently, browsers implement cross-origin access to the API differently:

**Cross-origin access is blocked in:**
- [Webkit](https://bugs.webkit.org/show_bug.cgi?id=150072)
- [Mozilla](https://hg.mozilla.org/releases/mozilla-aurora/rev/163849e878fc)

**Cross-origin access is allowed in:**
- Chromium ([Issue 598674](https://bugs.chromium.org/p/chromium/issues/detail?id=598674))
- Edge
- IE (IE11)

**Proposal:**
 - Make Security & Privacy normative
 - Block access to cross-origin iframes
 - As the Device Motion & Orientation exposes sensitive data, restrict access only to secure contexts
 - Reuse applicable mitigation strategies from Generic Sensor API https://w3c.github.io/sensors/#security-and-privacy

Please view or discuss this issue at https://github.com/w3c/deviceorientation/issues/46 using your GitHub account

Received on Tuesday, 21 November 2017 14:48:56 UTC