[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #91 from David Dorwin <ddorwin@google.com> ---
The TAG adopted the following resolution [1] on privacy-sensitive features, a
category that EME definitely falls into. Note that the TAG even supports
changing the behavior of existing APIs even if it breaks some content. As I
have said before, we should get it right the first time while we have a chance.

RESOLUTION: We support efforts by browser vendors to restrict privacy-sensitive
features to secure origins. This includes ones that have not historically been
restricted as such, like geolocation or webcam access.
We also support investigation into ways of preventing these features from
leaking to third-party scripts within a webpage (although the exact technology
to do so is unclear as yet, probably involving some combination of CSP and/or
something like ).
We appreciate this could cause some short and medium-term pain (breaking some
existing content), and so this needs to be done with care, but it is a worthy
goal to aspire to. 

[1]
https://github.com/w3ctag/meetings/blob/gh-pages/2014/sept29-oct1/09-29-f2f-minutes.md

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Friday, 24 October 2014 16:54:59 UTC