Re: [whatwg] Web Bluetooth API

http://webbluetoothcg.github.io/web-bluetooth/use-cases.html#security_privacy
lists some of the risks we want to avoid in implementations.

The basic model is that the website tells the UA what kinds of devices
it can productively connect to, and then the UA presents the user a
dialog from which to pick the particular device(s) to pair with the
website. Sites can never ask for global bluetooth access, and for
initial versions of the API, at least, we won't let them ask for an
entire class of devices at once. (It's possible a specially designed
class of devices could get around this by pretending to all be a
single device.)

There's a risk of websites attacking devices through this API. This is
currently mitigated by avoiding access to streaming protocols that
require the device to include a parser, and allowing access to the
GATT format, which defines key/value pairs. It's still likely that
some devices will be vulnerable to GATT messages, and we'll need to
keep consulting with various security teams to see whether that risk
is acceptable.

The third risk, of tracking the user through unique Bluetooth IDs, is
described in the current spec.

Is that the sort of answer you were looking for?

Thanks,
Jeffrey

On Sat, Aug 23, 2014 at 12:46 AM, Jonas Sicking <jonas@sicking.cc> wrote:
> The main question that I have is what is the security model?
>
> The security section of the spec is very light.
>
> / Jonas
>
> On Aug 22, 2014 6:34 PM, "Jeffrey Yasskin" <jyasskin@chromium.org> wrote:
>>
>> We have a draft API for Bluetooth device access at
>> https://webbluetoothcg.github.io/web-bluetooth/, for which I'm planning to
>> send a Blink Intent to Implement email soon. The spec isn't really up to
>> web standard quality yet: we're planning to refine it as we get feedback
>> from implementation and experimental use. However, we'd still appreciate
>> any feedback this group has on the current draft.
>>
>> Feedback as issues at
>> https://github.com/WebBluetoothCG/web-bluetooth/issues
>> will be easiest to incorporate. Feedback as replies to this email is still
>> welcome. Participation at
>> http://lists.w3.org/Archives/Public/public-web-bluetooth/ is even more
>> welcome. :)
>>
>> Thanks,
>> Jeffrey Yasskin
>>
>> P.S. I'll ping Monday so this doesn't get lost over the weekend, but want
>> to give anyone a chance to comment early if you want.

Received on Sunday, 24 August 2014 17:39:48 UTC