- From: Cullen Jennings (fluffy) <fluffy@cisco.com>
- Date: Mon, 6 Apr 2015 19:58:56 +0000
- To: Martin Thomson <martin.thomson@gmail.com>
- CC: Iñaki Baz Castillo <ibc@aliax.net>, "public-webrtc@w3.org" <public-webrtc@w3.org>
> On Jan 9, 2015, at 5:44 PM, Martin Thomson <martin.thomson@gmail.com> wrote: > > On 9 January 2015 at 15:36, Iñaki Baz Castillo <ibc@aliax.net> wrote: >> Let's simplify: do you agree that gUM should be able to be called when >> the page is loaded (without user interaction)? > > No. For the aforementioned reasons. Navigation is too easily under > attacker control. > > We might be able to carve out a few exceptions, but I tend to think > that an engagement gesture is necessary. > I would like the following use case to work (and I'm not claiming it does or does not, just that I hope it does). I have previously told my browser that hangouts can access my camera/microphone any time it wants and installed permanent permissions for the hangouts web site. In my calendar app such at outlook, I click on a URL to join the a hangout. (Note that from my point of view there was a user click to start the call here). The calendar app does whatever they do to cause the browser to launch that URL. Then the browser joins the call to hangout with out any more clicks. (Perhaps hangouts is an unrealistic example to use as it may have hair check screens before sending video but you get the idea)
Received on Monday, 6 April 2015 19:59:06 UTC