[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #124 from Anne <annevk@annevk.nl> ---
So it seems the problem we have is that the majority of implementations are
shipping without requiring TLS. We could require TLS in the specification, but
if the reality is that implementations do not require TLS, we might lose out on
requiring things that make sense in a non-TLS world.

Now that we require TLS, how likely is it that existing implementations will
change? I doubt new implementations will take the plunge given that EME
compatibility is complicated enough.

Now that we require TLS, how likely is it that existing implementations will
address non-TLS security and privacy concerns?

I'm all for requiring TLS, but in what timeframe can we move the
implementations there? And how do we protect users meanwhile?

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Wednesday, 29 October 2014 19:28:57 UTC