[Bug 17202] Explicitly document how keys are to be shared

https://www.w3.org/Bugs/Public/show_bug.cgi?id=17202

David Dorwin <ddorwin@google.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
                 CC|                            |hsivonen@iki.fi
         Resolution|LATER                       |---

--- Comment #3 from David Dorwin <ddorwin@google.com> ---
Reopening to make sure the spec is explicit about ways keys may and may NOT be
shared.

As mentioned in the original description, the intent was that keys are not
shared between HTMLMediaElements - now MediaKeys. I believe the spec has
progressed in this direction.  Some possible ways for an application to
explicitly share keys within a frame are covered by their own bugs:
MediaController (bug 16615) and sharing MediaKeys among HTMLMediaElements (bug
19009)

However, there have been discussions of retrieving saved keys or reusing keys
across tabs or browsing sessions. This may mostly apply to stored keys (see bug
21869), but it could also apply to in-memory keys. Domain keys and other key
hierarchies are some of the examples given.

Such sharing opens up the possibility of leaking information, especially across
origins. There are also issues of potentially sharing between normal and
Incognito/Private Browsing sessions, across profiles, and even across different
OS user accounts. Addressing these issues in the spec and/or implementations
would add a lot of complexity, and I think it would be best to avoid.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Tuesday, 6 August 2013 06:37:11 UTC