WebAPI/Security/Settings

Settings API

Brief purpose of API: API to configure device settings

General Use Cases: None

Inherent threats:

• Access sensitive configuration data (WiFi passwords etc)
• Change settings which might cost user money (data settings, roaming etc)
• Privacy implications

Threat severity: High

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=678695
• Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/jkzLINWWiQA/discussion

Permissions Table

Type	Use Cases	Authorization Model	Notes & Other Controls
Web Content	None	No access
Installed Web Apps	None	No access
Privileged Web Apps	None	No access
Certified Web Apps	Settings manager app	Implicit