Re: Additional protection against automatic camera capture (was: [Bug 25809] Security issue: Abuse of "call me" URLs) from Frederick Hirsch on 2014-09-18 (public-media-capture@w3.org from September 2014)

From: Frederick Hirsch <w3c@fjhirsch.com>
Date: Thu, 18 Sep 2014 09:29:45 -0400
To: Dominique Hazael-Massieux <dom@w3.org>
Cc: Frederick Hirsch <w3c@fjhirsch.com>, public-media-capture@w3.org
Message-Id: <495D3FB5-28AF-4A2A-916F-8F9F455FC24A@fjhirsch.com>

has PING weighed in on this?

regards, Frederick

Frederick Hirsch, Nokia
@fjhirsch



On Sep 15, 2014, at 11:32 AM, Dominique Hazael-Massieux <dom@w3.org> wrote:

> A couple of weeks ago, discussing bug 25809 (“call me” URLs), I
> suggested some potential additions to the spec to make it harder to trap
> users in getting automatically and unexpectedly “on air”:
> * requiring an engagement gesture for getUserMedia
> * linking permanent permissions to the embedded stack of origins
> * letting pages opt-in to allow their embedded frames to make use of
> getUserMedia
> 
> There was support from some, and hesitations from others.
> 
> To move forward with this, we could:
> * ask the chairs to call for consensus on this now
> * ask for further input from the Web Apps Security WG and/or the TAG
> * leave the spec as is, with a note asking for input from readers on
> these questions
> 
> Thoughts?
> 
> Dom
> 
> 
>

Received on Thursday, 18 September 2014 13:30:25 UTC