Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

On Tue, Oct 23, 2012 at 12:50 AM, Maciej Stachowiak <mjs@apple.com> wrote:

> Based on all this, I continue to think that requesting keyboard access
> should involve separate API, so that it can be feature-detected and given
> different security treatment by vendors as desired. This is what Flash
> does, and they have the most experience dealing with the security
> implications of fullscreen on the Web.
>
I support the notion that if not all vendors can agree on the exact
behavior/restrictions that an API is required to make this transparent to
the application developer both before attempting to request fullscreen
(capability discovery) and as a parameter to request fullscreen (which will
only succeed if that capability is offered).