[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #81 from Henri Sivonen <hsivonen@hsivonen.fi> ---
(In reply to Joe Steele from comment #80)
> Henri, this is a great writeup of a potential key delivery mechanism. I am
> confused though about your intent. Are you proposing that this be a mandated
> mechanism? Or is this being presented as an example of a key delivery
> architecture that would not require secure origins?

It shows how a key concern behind the proposal to require an authenticated
origin *could* be addressed even in hardware without external dependencies
(like ongoing maintenance of individualization server infrastructure to support
already-shipped devices). While I wish it could be mandated, so far the Task
Force has been shy to normatively require the DRM to have particular
characteristics, so I don't have my hopes high for *mandating* stuff. I think
the writeup could be used as input to make the suggestions in the Privacy
Considerations section more detailed, though.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Monday, 6 October 2014 10:06:03 UTC