Re: [webrtc-pc] RTCCertificate security boundary (#2343)

Okay, so there's two takeaways here:

1. Adding `Serializable=SameOrigin` to `RTCCertificate` is worth exploring, but it won't replace the need for the `[[Origin]]`` internal slot as `document.domain` would allow cross-origin sharing otherwise, which is problematic.
2. The specification should probably note that private keys need to be isolated from the processes that have access to `RTCCertificate` objects.

-- 
GitHub Notification of comment by annevk
Please view or discuss this issue at https://github.com/w3c/webrtc-pc/issues/2343#issuecomment-549715469 using your GitHub account

Received on Tuesday, 5 November 2019 08:27:29 UTC