WebAPI/Security/Idle: Difference between revisions

← Older edit

WebAPI/Security/Idle (view source)

Revision as of 23:40, 1 October 2014

322 bytes removed , 1 October 2014

no edit summary

Chaasof

Confirmed users

1,340

edits

@@ Line 1: / Line 1: @@
-Name of API: Idle API
+==Idle API==
+Brief purpose of API: Notify an app if the user is idle.<br>
+General Use Cases: Notify a web page is a user is idle (e.g. to change a status in an instant messaging program).
 References:
@@ Line 5: / Line 8: @@
 *Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/Wxgz7_LKD40/discussion
-Brief purpose of API: Notify an app if the user is idle
+Inherent threats:
+*Privacy implications
-General Use Cases: Notify a web page is a user is idle (e.g. to change a status in an instant messaging program).
+**Signalling multiple windows at exactly the same time could correlate user identities and compromise privacy
+**Could be used by a workplace to monitor activity by monitoring system idle
-Inherent threats:<br>
-Privacy implication
-*signalling multiple windows at exactly the same time could correlate user identities and compromise privacy
-*Could be used by a workplace to monitor activity by monitoring system idle
 Threat severity: Low
-== Regular web content (unauthenticated) ==
+=== Permissions Table===
-Use cases for unauthenticated code: Idle detection for IM or IRC clients.
-Authorization model for normal content: None
-Authorization model for installed web content: None
-Potential mitigations:
-* Exact time user goes idle can be fuzzed so as to reduce correlation
-* Provide only page idle not system idle, where privacy is a concern
-== Privileged (approved by app store) ==
-Use cases for privileged code: N/A
-Authorization model: None
-Potential mitigations: None
-== Certified (system-critical apps) ==
-Use cases for certified code: As per unauthenticated
-Authorization model: Implicit
+{| border="1" class="wikitable"
+! Type
+! Use Cases
+! Authorization Model
+|-
+| Web Content || None || No access
+|-
+| Installed Web Apps || None || No access
+|-
+| Privileged Web Apps || None || No access
+|-
+| Certified Web Apps || Notify an app if the user is idle. || Implicit
+|}
-Potential mitigations: Implicit
+[[Category:Web APIs]]
+[[Category:Security]]