WebAPI/Security/SMS

Name of API: Web SMS API

References: https://bugzilla.mozilla.org/show_bug.cgi?id=674725
Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/58a66963732b09a0/9ae97f65a9e74c78

Brief purpose of API: Send and recieve SMS messages

General Use Cases: None

Inherent threats:

• Sending an SMS costs user money, premium SMS services, SMS payments etc
• Receiving SMS has privacy implications, SMS also used for 2-factor authentication

Threat severity: critical per https://wiki.mozilla.org/Security_Severity_Ratings

Regular web content (unauthenticated)

Use cases for unauthenticated code: App prompts user to send SMS

Authorization model for uninstalled web content: Explicit (via web activities)

Authorization model for installed web content: Explicit (via web activities)

Potential mitigations:

Trusted (authenticated by publisher)

Use cases for authenticated code: Full-featured SMS app. Read & send SMS.

Authorization model: Explicit

Potential mitigations: Check your phone bill?

Certified (vouched for by trusted 3rd party)

Use cases for certified code: SMS app

Authorization model: Implicit

Potential mitigations: None beyond certification

Note: Should trusted apps be able to register as handlers for SMS web activities/intents, or only certified apps?