[webrtc-pc] Considering making RTCCertificate throw when serialized when _forStorage_ is false (#2257)

annevk has just created a new issue for https://github.com/w3c/webrtc-pc:

== Considering making RTCCertificate throw when serialized when _forStorage_ is false ==
This would make `postMessage()` and friends throw and only allow same-origin usage of the object as seems to be intended. This would allow you to get rid of the `[[Origin]]` field and prevent inadvertent sharing of this object with untrusted origins (who might be able to Spectre-attack its contents at that point, unless the user agent has a more convoluted design whereby it only messages a pointer around and keeps the actual underlying data only in processes accessible to the origin that created it).

Please view or discuss this issue at https://github.com/w3c/webrtc-pc/issues/2257 using your GitHub account

Received on Tuesday, 6 August 2019 14:17:34 UTC