Re: ISSUE-3: Security concerns around Home Networking APIs

[Samsung] Security/Privacy for UPnP/DLNA HN devices was a significant concern during the development of CEA-2014-B(Remote UI). 

The following measures were implemented:

1. By default pages that accessed HN devices were opened in "sandbox" mode where access to services such as cookies, XHR and Forms that could be used to upload information outside the home were restricted. The page could detect if the browser was in this mode. The UA could designate "trusted" domains where HN pages were permitted full access to UA facilities. 

2. HN devices were protected by user-assigned passwords that were stored/managed by the UA. Pages accessing HN devices would be required to provide the correct password to the UA before it would "unlock" page access to HN Methods. Note some methods were non-password protected to allow basic device discovery to take place. The UA was required to expire passwords in which case the page would need to resubmit password to contine to have access to the device.