View source for Apps/Security/Discussion

= Boot 2 Gecko App Security Model Discussion =
This page is for capturing information about the B2G/OWA security discussion. 
{{note|<b>This is not a design document and should not be considered authoritative at this time</b>}}
{{note|<b>This page has been subdivided into sections that have their own page but have been [http://en.wikipedia.org/wiki/Wikipedia:Transclusion transcluded].  If it is easier (less intimidating), each section may be edited as its own page.</b>}}

There are four separate areas where security work is required.  Each area is separate but inter-related.  Each is '''required''' and cannot be ignored.

* [[Apps/Security/Distribution|'''Secure Application Distribution''']].
  A level of trust must be established between all four parties: B2G developers, Application developers, users and stores.
* [[Apps/Security/Enforcement|'''Application Permissions Enforcement''']].
  This can '''only''' be done at the Operating System (kernel) level.
* [[Apps/Security/Permissions|'''Definition, management and presentation of the permissions to be enforced''']].
  Examples include "app can access the IMEI number" and "app can make phone calls".
* [[Apps/Security/StandardWebSecurity|'''Standard web security''']].
  This is what is normally considered to be "the web" (XSS in AJAX etc.) and it still has a role to play in B2G.

Additional reading and links:
* Track the status of [[B2G_App_Security_Model]]
* Track the status of [[B2G_App_Security_Model/Threat_Model]]
* [https://developer.mozilla.org/en/OpenWebApps OWA developer page]

__TOC__

{{:Apps/Security/Definitions}}
{{:Apps/Security/Bugs}}
{{:Apps/Security/Summary}}
{{:Apps/Security/Distribution}}
{{:Apps/Security/Enforcement}}
{{:Apps/Security/Permissions}}
{{:Apps/Security/StandardWebSecurity}}
{{:Apps/Security/Other}}