WebAPI/Security/Vibration - Revision history

Chaasof at 23:42, 1 October 2014

2014-10-01T23:42:24Z

← Older revision		Revision as of 23:42, 1 October 2014
Line 34:		Line 34:

	__NOTOC__		__NOTOC__

			[[Category:Web APIs]]
			[[Category:Security]]

Ptheriault: /* Vibration */

2012-09-24T04:16:26Z

Vibration

← Older revision		Revision as of 04:16, 24 September 2012
Line 12:		Line 12:

	Notes:		Notes:
	* User can deny from Permission Manager to override an abusive app ~~(not currently implemented)~~.		* User can deny from Permission Manager to override an abusive app.
	* Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.		* Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.

Ptheriault at 04:07, 24 September 2012

2012-09-24T04:07:56Z

← Older revision		Revision as of 04:07, 24 September 2012
Line 1:		Line 1:
	== Vibration ==		== Vibration ==
	Brief purpose of API: Let content activate the vibration motor.		Brief purpose of API: Let content activate the vibration motor.
			General use cases: Vibrate when hit in a game etc.
	General use cases: Vibrate when hit in a game,

	Reference: http://dev.w3.org/2009/dap/vibration/		Reference: http://dev.w3.org/2009/dap/vibration/
Line 11:		Line 10:

	Threat severity: low		Threat severity: low

			Notes:
			* User can deny from Permission Manager to override an abusive app (not currently implemented).
			* Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.

	=== Permissions Table===		=== Permissions Table===
Line 29:		Line 32:
	\|}		\|}


	~~==Notes==~~
	~~This API may be implicitly granted. User can deny from Permission Manager to override an abusive app.~~
	~~Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.~~

	__NOTOC__		__NOTOC__

Ptheriault at 04:06, 24 September 2012

2012-09-24T04:06:27Z

@@ Line 1: / Line 1: @@
-Name of API: Vibration
+== Vibration ==
 Reference: http://dev.w3.org/2009/dap/vibration/
@@ Line 5: / Line 8: @@
 Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#
-Brief purpose of API: Let content activate the vibration motor
+Inherent threats: Obnoxious if abused, consume extra battery.
 Threat severity: low
-== Regular web content (unauthenticated) ==
+=== Permissions Table===
-Authorization model: Implicit
+{| border="1" class="wikitable"
 ==Notes==
-This API may be implicitly granted.  User can deny from Permission Manager to over-ride an abusive app.
+This API may be implicitly granted.  User can deny from Permission Manager to override an abusive app.
 Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.
 __NOTOC__

Ladamski at 21:16, 6 August 2012

2012-08-06T21:16:46Z

← Older revision		Revision as of 21:16, 6 August 2012
Line 21:		Line 21:

	== Privileged (approved by app store) ==		== Privileged (approved by app store) ==
	~~<p>~~Use cases for ~~authenticated~~ code: [Same]		Use cases for privileged code: [Same]
	~~</p><p>Authorization model: Implicit~~
	~~</p><p>Potential mitigations:~~
	~~</p>~~

	== ~~Privileged~~ (~~approved by app store~~) ==		Authorization model: Implicit
	Use cases for ~~privileged~~ code:
			Potential mitigations:

			== Certified (system-critical apps) ==
			Use cases for certified code: [Same]

	Authorization model: Implicit		Authorization model: Implicit
Line 33:		Line 34:
	Potential mitigations:		Potential mitigations:

	Notes: This API may be implicitly granted. User can deny from Permission Manager to over-ride an abusive app.		==Notes==
			This API may be implicitly granted. User can deny from Permission Manager to over-ride an abusive app.
	Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.		Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.

	~~== Certified (system-critical apps) ==~~		__NOTOC__
	~~Same as Privileged~~

Ladamski at 21:13, 6 August 2012

2012-08-06T21:13:43Z

← Older revision		Revision as of 21:13, 6 August 2012
Line 3:		Line 3:
	Reference: http://dev.w3.org/2009/dap/vibration/		Reference: http://dev.w3.org/2009/dap/vibration/

	~~Background~~ Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#		Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#

	Brief purpose of API: Let content activate the vibration motor		Brief purpose of API: Let content activate the vibration motor
Line 20:		Line 20:
	Potential mitigations: Limit how long vibrations can run. Only foreground content can trigger vibration.		Potential mitigations: Limit how long vibrations can run. Only foreground content can trigger vibration.

	~~<h2>~~ Privileged (approved by app store) ~~</h2>~~		== Privileged (approved by app store) ==
	<p>Use cases for authenticated code: [Same]		<p>Use cases for authenticated code: [Same]
	</p><p>Authorization model: Implicit		</p><p>Authorization model: Implicit
Line 26:		Line 26:
	</p>		</p>

	== ~~Certified~~ (~~vouched for~~ by ~~trusted 3rd party~~) ==		== Privileged (approved by app store) ==
	Use cases for ~~certified~~ code:		Use cases for privileged code:

	Authorization model: Implicit		Authorization model: Implicit
Line 35:		Line 35:
	Notes: This API may be implicitly granted. User can deny from Permission Manager to over-ride an abusive app.		Notes: This API may be implicitly granted. User can deny from Permission Manager to over-ride an abusive app.
	Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.		Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.

			== Certified (system-critical apps) ==
			Same as Privileged

Ladamski: /* Trusted (authenticated by publisher) */

2012-08-06T21:03:30Z

Trusted (authenticated by publisher)

← Older revision		Revision as of 21:03, 6 August 2012
Line 20:		Line 20:
	Potential mitigations: Limit how long vibrations can run. Only foreground content can trigger vibration.		Potential mitigations: Limit how long vibrations can run. Only foreground content can trigger vibration.

	~~== Trusted~~ (~~authenticated~~ by ~~publisher~~) ==		<h2> Privileged (approved by app store) </h2>
	Use cases for authenticated code:[Same]		<p>Use cases for authenticated code: [Same]
			</p><p>Authorization model: Implicit
	Authorization model: Implicit		</p><p>Potential mitigations:
			</p>
	Potential mitigations:

	== Certified (vouched for by trusted 3rd party) ==		== Certified (vouched for by trusted 3rd party) ==

Ladamski at 13:24, 25 June 2012

2012-06-25T13:24:12Z

← Older revision		Revision as of 13:24, 25 June 2012
Line 1:		Line 1:
	Name of API: Vibration		Name of API: Vibration

	Reference: http://dev.w3.org/2009/dap/vibration/		Reference: http://dev.w3.org/2009/dap/vibration/

Ladamski at 00:20, 2 May 2012

2012-05-02T00:20:33Z

← Older revision		Revision as of 00:20, 2 May 2012
Line 1:		Line 1:
	Name of API: Vibration		Name of API: Vibration
	Reference: http://dev.w3.org/2009/dap/vibration/		Reference: http://dev.w3.org/2009/dap/vibration/

			Background Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#

	Brief purpose of API: Let content activate the vibration motor		Brief purpose of API: Let content activate the vibration motor

Ladamski at 00:18, 2 May 2012

2012-05-02T00:18:36Z

← Older revision		Revision as of 00:18, 2 May 2012
Line 5:		Line 5:

	Inherent threats: Obnoxious if mis-used, consume extra battery		Inherent threats: Obnoxious if mis-used, consume extra battery

	Threat severity: low		Threat severity: low

	== Regular web content (unauthenticated) ==		== Regular web content (unauthenticated) ==
	Use cases for unauthenticated code: Vibrate when hit in a game		Use cases for unauthenticated code: Vibrate when hit in a game

	Authorization model for uninstalled web content: Implicit		Authorization model for uninstalled web content: Implicit

	Authorization model for installed web content: Implicit		Authorization model for installed web content: Implicit

	Potential mitigations: Limit how long vibrations can run. Only foreground content can trigger vibration.		Potential mitigations: Limit how long vibrations can run. Only foreground content can trigger vibration.

	== Trusted (authenticated by publisher) ==		== Trusted (authenticated by publisher) ==
	Use cases for authenticated code:[Same]		Use cases for authenticated code:[Same]

	Authorization model: Implicit		Authorization model: Implicit

	Potential mitigations:		Potential mitigations:

	== Certified (vouched for by trusted 3rd party) ==		== Certified (vouched for by trusted 3rd party) ==
	Use cases for certified code:		Use cases for certified code:

	Authorization model: Implicit		Authorization model: Implicit

	Potential mitigations:		Potential mitigations:

	Notes: This API may be implicitly granted. User can deny from Permission Manager to over-ride an abusive app.		Notes: This API may be implicitly granted. User can deny from Permission Manager to over-ride an abusive app.
	Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.		Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.