WebAPI/Security/FMRadioAPI: Difference between revisions

← Older edit

WebAPI/Security/FMRadioAPI (view source)

Revision as of 23:40, 1 October 2014

170 bytes added , 1 October 2014

no edit summary

Chaasof

Confirmed users

1,340

edits

@@ Line 1: / Line 1: @@
-== FM Radio API==
+==WebFM API==
-Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=749053
 Brief purpose of API: FM radio feature.
 General Use Cases: Turn on/off the radio, change frequency, check status of various radio features
 Inherent threats: annoyance, drain the battery
-Threat severity: low
+Threat severity: Low
 General notes:
-*Multiple apps/pages can try to modify radio settings at the same time with the most recent action taking effect.
+Multiple apps/pages can try to modify radio settings at the same time with the most recent action taking effect.  Turning on the radio causes the audio stream to be played - there is no access to the stream data
-*Turning on the radio causes the audio stream to be played - there is no access to the stream data
+References:
+*https://bugzilla.mozilla.org/show_bug.cgi?id=749053
+*https://groups.google.com/d/topic/mozilla.dev.webapi/PraULCQntqA/discussion
+=== Permissions Table===
-=== Regular web content (unauthenticated) ===
+{| border="1" class="wikitable"
-*Use  cases for unauthenticated code: radio app/web page
+! Type
-*Authorization model for normal content: explicit
+! Use Cases
-*Authorization model for installed content: implicit
+! Authorization Model
-*Potential mitigations: An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always resent the current frequency to some specified value
+! Notes & Other Controls
+|-
+| Web Content || radio app/web page || Explicit ||  An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always reset the current frequency to some specified value
+|-
+| Installed Web Apps || radio app/web page || Implicit ||  An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always reset the current frequency to some specified value
+|-
+| Privileged Web Apps || radio app || Implicit ||
+|-
+| Certified Web Apps || radio app || Implicit || Same as for unauthenticated. Technically we wouldn't need to reset the frequency here, but seems nicer to keep things consistent.
+|}
-=== Trusted (authenticated by publisher) ===
+__NOTOC__
-*Use cases for certified code:  radio app
-*Authorization model: Implicit
-*Potential mitigations: Same as for unauthenticated.
-=== Certified (vouched for by trusted 3rd party) ===
+[[Category:Web APIs]]
-*Use cases for certified code:  radio app
+[[Category:Security]]
-*Authorization model: Implicit
-*Potential mitigations: Same as for unauthenticated. Technically we wouldn't need to resent the frequency here, but seems nicer to keep things consistent.