WebAPI/Security/Vibration: Difference between revisions

Jump to navigation Jump to search

WebAPI/Security/Vibration (view source)

Revision as of 04:06, 24 September 2012

167 bytes added ,  24 September 2012
no edit summary
No edit summary
No edit summary
Line 1: Line 1:
Name of API: Vibration
== Vibration ==
Brief purpose of API: Let content activate the vibration motor.
 
General use cases: Vibrate when hit in a game,


Reference: http://dev.w3.org/2009/dap/vibration/
Reference: http://dev.w3.org/2009/dap/vibration/
Line 5: Line 8:
Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#
Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/6aa715e1d7a5a9f5#


Brief purpose of API: Let content activate the vibration motor
Inherent threats: Obnoxious if abused, consume extra battery.
 
Inherent threats: Obnoxious if mis-used, consume extra battery


Threat severity: low
Threat severity: low


== Regular web content (unauthenticated) ==
=== Permissions Table===
Use cases for unauthenticated code: Vibrate when hit in a game
 
Authorization model for uninstalled web content: Implicit
 
Authorization model for installed web content: Implicit
 
Potential mitigations: Limit how long vibrations can run.  Only foreground content can trigger vibration.
 
== Privileged (approved by app store) ==
Use cases for privileged code: [Same]
 
Authorization model: Implicit
 
Potential mitigations:
 
== Certified (system-critical apps) ==
Use cases for certified code: [Same]


Authorization model: Implicit
{| border="1" class="wikitable"
! Type
! Use Cases
! Authorization Model
! Notes & Other Controls
|-
| Web Content || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
|-
| Installed Web Apps || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
|-
| Privileged Web Apps || As per general use case. || Implicit|| Limit how long vibrations can run.  Only foreground content can trigger vibration.
|-
| Certified Web Apps || As per general use case. || Implicit || Limit how long vibrations can run.  Only foreground content can trigger vibration.
|}


Potential mitigations:


==Notes==
==Notes==
This API may be implicitly granted.  User can deny from Permission Manager to over-ride an abusive app.
This API may be implicitly granted.  User can deny from Permission Manager to override an abusive app.
Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.
Since only foreground content can trigger vibrator, this seems equivalent to other potentially annoying feedback mechanisms and should be implicit for uninstalled web content.


__NOTOC__
__NOTOC__
Ptheriault
canmove, Confirmed users
1,220

edits

Retrieved from "https://wiki.allizom.org/Special:MobileDiff/472943"

Navigation menu