[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

Jerry Smith <jdsmith@microsoft.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jdsmith@microsoft.com

--- Comment #15 from Jerry Smith <jdsmith@microsoft.com> ---
We should also consider intranet use when imposing https as a prerequisite for
using EME.  That situation may clearly not warrant https, and it would make
sense to give companies the option to use http.

The ID exposure originally mentioned as a concern seems well protected already.
 It would require implementing a license server to retrieve and access the ID. 
Further, I believe most DRMs that return this ID already protect as part of the
license message.

Given this, I don't think we should wire EME to fail on http sites, but have no
objection to recommending its use.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Tuesday, 29 July 2014 00:00:44 UTC