WebAPI/Security/Idle: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
No edit summary
No edit summary
 
(3 intermediate revisions by one other user not shown)
Line 1: Line 1:
Name of API: Idle API
==Idle API==
 
Brief purpose of API: Notify an app if the user is idle.<br>
General Use Cases: Notify a web page is a user is idle (e.g. to change a status in an instant messaging program).


References:
References:
*https://wiki.mozilla.org/WebAPI/IdleAPI
*https://wiki.mozilla.org/WebAPI/IdleAPI
*Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/Wxgz7_LKD40/discussion
*Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/Wxgz7_LKD40/discussion
Brief purpose of API: Notify an app if the user is idle.<br>
General Use Cases: Notify a web page is a user is idle (e.g. to change a status in an instant messaging program).


Inherent threats:
Inherent threats:
Line 14: Line 14:
Threat severity: Low
Threat severity: Low


=== Permissions Table===


{| border="1" class="wikitable"
{| border="1" class="wikitable"
Line 29: Line 30:
|}
|}


 
[[Category:Web APIs]]
=== Regular web content (unauthenticated) ===
[[Category:Security]]
Use cases for unauthenticated code: None.
Authorization model for normal content: No Access.
 
*Installed Web Apps
**Use cases for unauthenticated code: None.
**Authorization model for normal content: No access.
*Privileged (approved by app store)
*Use cases for privileged code: None.
**Authorization model: No access.
 
=== Certified (system-critical apps) ===
Use cases for certified code: Notify an app if the user is idle <br>
Authorization model: Implicit <br>
Potential mitigations: Due to the privacy risks associated with this API, access is limited to certified applications. (See https://bugzilla.mozilla.org/show_bug.cgi?id=780507 for further detail).

Latest revision as of 23:40, 1 October 2014

Idle API

Brief purpose of API: Notify an app if the user is idle.
General Use Cases: Notify a web page is a user is idle (e.g. to change a status in an instant messaging program).

References:

Inherent threats:

  • Privacy implications
    • Signalling multiple windows at exactly the same time could correlate user identities and compromise privacy
    • Could be used by a workplace to monitor activity by monitoring system idle

Threat severity: Low

Permissions Table

Type Use Cases Authorization Model
Web Content None No access
Installed Web Apps None No access
Privileged Web Apps None No access
Certified Web Apps Notify an app if the user is idle. Implicit
Retrieved from "https://wiki.mozilla.org/index.php?title=WebAPI/Security/Idle&oldid=1021339"