WebAPI/Security/Vibration: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
No edit summary
No edit summary
 
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Name of API: Vibration
== Vibration ==
Brief purpose of API: Let content activate the vibration motor.
General use cases: Vibrate when hit in a game etc.


Reference: http://dev.w3.org/2009/dap/vibration/
Reference: http://dev.w3.org/2009/dap/vibration/
Line 5: Line 7:
Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#
Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#


Brief purpose of API: Let content activate the vibration motor
Inherent threats: Obnoxious if abused, consume extra battery.
 
Inherent threats: Obnoxious if mis-used, consume extra battery


Threat severity: low
Threat severity: low


== Regular web content (unauthenticated) ==
Notes:
Use cases for unauthenticated code: Vibrate when hit in a game
* User can deny from Permission Manager to override an abusive app.
 
* Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.
Authorization model for uninstalled web content: Implicit
 
Authorization model for installed web content: Implicit
 
Potential mitigations: Limit how long vibrations can run. Only foreground content can trigger vibration.
 
== Privileged (approved by app store) ==
<p>Use cases for authenticated code: [Same]
</p><p>Authorization model: Implicit
</p><p>Potential mitigations:
</p>


== Privileged (approved by app store) ==
=== Permissions Table===
Use cases for privileged code:


Authorization model: Implicit
{| border="1" class="wikitable"
! Type
! Use Cases
! Authorization Model
! Notes & Other Controls
|-
| Web Content || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
|-
| Installed Web Apps || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
|-
| Privileged Web Apps || As per general use case. || Implicit|| Limit how long vibrations can run.  Only foreground content can trigger vibration.
|-
| Certified Web Apps || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
|}


Potential mitigations:


Notes:  This API may be implicitly granted.  User can deny from Permission Manager to over-ride an abusive app.
__NOTOC__
Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.


== Certified (system-critical apps) ==
[[Category:Web APIs]]
Same as Privileged
[[Category:Security]]

Latest revision as of 23:42, 1 October 2014

Vibration

Brief purpose of API: Let content activate the vibration motor. General use cases: Vibrate when hit in a game etc.

Reference: http://dev.w3.org/2009/dap/vibration/

Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#

Inherent threats: Obnoxious if abused, consume extra battery.

Threat severity: low

Notes:

  • User can deny from Permission Manager to override an abusive app.
  • Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.

Permissions Table

Type Use Cases Authorization Model Notes & Other Controls
Web Content As per general use case. Implicit Limit how long vibrations can run. Only foreground content can trigger vibration.
Installed Web Apps As per general use case. Implicit Limit how long vibrations can run. Only foreground content can trigger vibration.
Privileged Web Apps As per general use case. Implicit Limit how long vibrations can run. Only foreground content can trigger vibration.
Certified Web Apps As per general use case. Implicit Limit how long vibrations can run. Only foreground content can trigger vibration.
Retrieved from "https://wiki.mozilla.org/index.php?title=WebAPI/Security/Vibration&oldid=1021351"