MozillaWiki

WebAPI/Security/Idle: Difference between revisions

Page Discussion

WebAPI/Security/Idle (view source)

Revision as of 23:40, 1 October 2014

322 bytes removed ,  1 October 2014
no edit summary
mNo edit summary
No edit summary
 
(4 intermediate revisions by one other user not shown)
Line 1: Line 1:
Name of API: Idle API
==Idle API==
 
Brief purpose of API: Notify an app if the user is idle.<br>
General Use Cases: Notify a web page is a user is idle (e.g. to change a status in an instant messaging program).


References:
References:
*https://wiki.mozilla.org/WebAPI/IdleAPI
*https://wiki.mozilla.org/WebAPI/IdleAPI
*Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/Wxgz7_LKD40/discussion
*Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/Wxgz7_LKD40/discussion
Brief purpose of API: Notify an app if the user is idle
General Use Cases: Notify a web page is a user is idle (e.g. to change a status in an instant messaging program).


Inherent threats:
Inherent threats:
Line 13: Line 12:
**Signalling multiple windows at exactly the same time could correlate user identities and compromise privacy
**Signalling multiple windows at exactly the same time could correlate user identities and compromise privacy
**Could be used by a workplace to monitor activity by monitoring system idle
**Could be used by a workplace to monitor activity by monitoring system idle
Threat severity: Low
Threat severity: Low


== Regular web content (unauthenticated) ==
=== Permissions Table===
Use cases for unauthenticated code: Idle detection for IM or IRC clients.
 
Authorization model for normal content: None
 
Authorization model for installed web content: None
 
Potential mitigations:
* Exact time user goes idle can be fuzzed so as to reduce correlation
* Provide only page idle not system idle, where privacy is a concern
 
== Privileged (approved by app store) ==
Use cases for privileged code: N/A
 
Authorization model: None
 
Potential mitigations: None
 
== Certified (system-critical apps) ==
Use cases for certified code: As per unauthenticated


Authorization model: Implicit
{| border="1" class="wikitable"
! Type
! Use Cases
! Authorization Model
|-
| Web Content || None || No access
|-
| Installed Web Apps || None || No access
|-
| Privileged Web Apps || None || No access
|-
| Certified Web Apps || Notify an app if the user is idle. || Implicit
|}


Potential mitigations: Implicit
[[Category:Web APIs]]
[[Category:Security]]
Chaasof
Confirmed users
1,340

edits

Retrieved from "https://wiki.allizom.org/Special:MobileDiff/458297...1021339"