W3C home > Mailing lists > Public > public-webrtc@w3.org > February 2020

[webrtc-pc] `getCapabilities` seems to leak hardware capabilities w/o a permission (#2460)

From: Bernard Aboba via GitHub <sysbot+gh@w3.org>
Date: Tue, 04 Feb 2020 20:03:18 +0000
To: public-webrtc@w3.org
Message-ID: <issues.opened-559948306-1580846596-sysbot+gh@w3.org>
aboba has just created a new issue for https://github.com/w3c/webrtc-pc:

== `getCapabilities` seems to leak hardware capabilities w/o a permission ==
Moved from the WebRTC-SVC repo: https://github.com/w3c/webrtc-svc/issues/22

Opened by snyderp

Apologies if I'm misreading the spec, but if I'm reading it correctly it looks like a site can learn about the visitors underlying hardware capabilities w/o a permission prompt or some other positive, affirmative action by the visitor.

Is my reading of the spec correct then, there is a FP vector exposed by the current text that would need to be mitigated (e.g. sites couldn't access it by default).

Otherwise, if this is addressed elsewhere, could you kindly point me to where, so I dont make the same mistake twice? :) Thanks!

Please view or discuss this issue at https://github.com/w3c/webrtc-pc/issues/2460 using your GitHub account
Received on Tuesday, 4 February 2020 20:03:19 UTC

This archive was generated by hypermail 2.4.0 : Tuesday, 4 February 2020 20:03:20 UTC