WebAPI/Security/Settings: Difference between revisions
Jump to navigation
Jump to search
Ptheriault (talk | contribs) No edit summary |
No edit summary |
||
| Line 30: | Line 30: | ||
| Certified Web Apps || Settings manager app || Implicit | | Certified Web Apps || Settings manager app || Implicit | ||
|} | |} | ||
[[Category:Web APIs]] | |||
[[Category:Security]] | |||
Latest revision as of 23:42, 1 October 2014
Settings API
Brief purpose of API: API to configure device settings
General Use Cases: None
Inherent threats:
- Access sensitive configuration data (WiFi passwords etc)
- Change settings which might cost user money (data settings, roaming etc)
- Privacy implications
Threat severity: High
References:
- https://bugzilla.mozilla.org/show_bug.cgi?id=678695
- Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/jkzLINWWiQA/discussion
Permissions Table
| Type | Use Cases | Authorization Model | Notes & Other Controls |
|---|---|---|---|
| Web Content | None | No access | |
| Installed Web Apps | None | No access | |
| Privileged Web Apps | None | No access | |
| Certified Web Apps | Settings manager app | Implicit |