- From: <henry.story@bblfish.net>
- Date: Thu, 1 Oct 2015 21:02:18 +0100
- To: Anders Rundgren <anders.rundgren.net@gmail.com>
- Cc: Alex Russell <slightlyoff@google.com>, Tony Arcieri <bascule@gmail.com>, GALINDO Virginie <Virginie.Galindo@gemalto.com>, "public-web-security@w3.org" <public-web-security@w3.org>
> On 1 Oct 2015, at 19:40, Anders Rundgren <anders.rundgren.net@gmail.com> wrote:
>
> Since Microsoft and Mozilla have decided to implement Chrome extensions
> including Native Messaging this topic has effectively left the W3C
> so we can safely put it to rest. Problem solved :-)
Whether it is specified in the W3C or not is not really relevant,
since other features like TLS, FIDO, OpendID or OAuth are also specified
outside of the W3C but are part of the debate.
I don't know much about Native Messaging, but following the link
from the wiki [1] I arrived at the API spec, where I see that there
are some restrictions as to what domains the extension can work with.
https://developer.chrome.com/extensions/messaging#external-webpage
The extension has to specify in its Manifest from which domains it wishes
to receive messages. The example given is:
"externally_connectable": {
"matches": ["*://*.example.com/*"]
}
So clearly this allows cross origins use of the extension, which can presumably
keep data in the external application and then use that to communicate with the
other sites specified in the manifest.
Where in the case of FIDO we have the web site limiting the use of key within
some limits imposed on it, here we have the extension limiting which sites can
use it.
This would actually be much more interesting if one could devise a method by
which extensions could securely and without name clashes work with any site.
Here it seems a bit half way in both directions.
As I said I am new to this space, so I am happy to be corrected here.
Henry
[1] https://blog.chromium.org/2013/10/connecting-chrome-apps-and-extensions.html
Henry
Received on Thursday, 1 October 2015 20:02:54 UTC