WebAPI/Security/Vibration: Difference between revisions

← Older edit

WebAPI/Security/Vibration (view source)

Revision as of 23:42, 1 October 2014

179 bytes added , 1 October 2014

no edit summary

Chaasof

Confirmed users

1,340

edits

@@ Line 1: / Line 1: @@
-Name of API: Vibration
+== Vibration ==
+Brief purpose of API: Let content activate the vibration motor.
+General use cases: Vibrate when hit in a game etc.
 Reference: http://dev.w3.org/2009/dap/vibration/
@@ Line 5: / Line 7: @@
 Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#
-Brief purpose of API: Let content activate the vibration motor
+Inherent threats: Obnoxious if abused, consume extra battery.
-Inherent threats: Obnoxious if mis-used, consume extra battery
 Threat severity: low
-== Regular web content (unauthenticated) ==
+Notes:
-Use cases for unauthenticated code: Vibrate when hit in a game
+* User can deny from Permission Manager to override an abusive app.
+* Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.
-Authorization model for uninstalled web content: Implicit
+=== Permissions Table===
-Authorization model for installed web content: Implicit
+{| border="1" class="wikitable"
+! Type
+! Use Cases
+! Authorization Model
+! Notes & Other Controls
+|-
+| Web Content || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
+|-
+| Installed Web Apps || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
+|-
+| Privileged Web Apps || As per general use case. || Implicit|| Limit how long vibrations can run.  Only foreground content can trigger vibration.
+|-
+| Certified Web Apps || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
+|}
-Potential mitigations: Limit how long vibrations can run.  Only foreground content can trigger vibration.
-== Privileged (approved by app store) ==
+__NOTOC__
-Use cases for privileged code: [Same]
-Authorization model: Implicit
+[[Category:Web APIs]]
+[[Category:Security]]
-Potential mitigations:
-== Certified (system-critical apps) ==
-Use cases for certified code: [Same]
-Authorization model: Implicit
-Potential mitigations:
-==Notes==
-This API may be implicitly granted.  User can deny from Permission Manager to over-ride an abusive app.
-Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.
-__NOTOC__