WebAPI/Security/Bluetooth: Difference between revisions
No edit summary |
No edit summary |
||
| Line 10: | Line 10: | ||
Inherent threats: Privacy, access to sensitive user devices, de-anonimization based on bluetooth state | Inherent threats: Privacy, access to sensitive user devices, de-anonimization based on bluetooth state | ||
Threat severity: | Threat severity: High | ||
== Regular web content (unauthenticated) == | == Regular web content (unauthenticated) == | ||
| Line 21: | Line 21: | ||
Potential mitigations: | Potential mitigations: | ||
== | == Privileged (approved by app store) == | ||
Use cases: None | Use cases: None | ||
| Line 28: | Line 28: | ||
Potential mitigations: | Potential mitigations: | ||
== Certified ( | == Certified (system-critical apps) == | ||
Use cases: | Use cases: | ||
*Read bluetooth adapter state | *Read bluetooth adapter state | ||
Revision as of 23:31, 6 August 2012
Web Bluetooth API
References:
Brief purpose of API: The aim of WebBluetooth is to establish a DOM API to set up and communicate with Bluetooth devices. This includes setting properties on adapters and devices, scanning for devices, bonding, and socket initialization for audio and communication.
General Use Cases:
Inherent threats: Privacy, access to sensitive user devices, de-anonimization based on bluetooth state
Threat severity: High
Regular web content (unauthenticated)
Use cases: None
Authorization model for normal content: None
Authorization model for installed content: None
Potential mitigations:
Privileged (approved by app store)
Use cases: None
Authorization model: None
Potential mitigations:
Certified (system-critical apps)
Use cases:
- Read bluetooth adapter state
- Start/Stop device discovery
- List discoverd devices
- Pair with device
Authorization model: Implicit
Potential mitigations: Status indicator showing active bluetooth connection, user can click the status indicator to cancel the connection. Any limit on types of devices?
Notes
Non-certified use cases are out of scope for 1.0. We will consider those for a subsequent release.