WebAPI/Security/Bluetooth: Difference between revisions
Jump to navigation
Jump to search
Ptheriault (talk | contribs) No edit summary |
Ptheriault (talk | contribs) |
||
Line 21: | Line 21: | ||
! Notes & Other Controls | ! Notes & Other Controls | ||
|- | |- | ||
| Web Content || None || No access | | Web Content || None || No access || | ||
|- | |- | ||
| Installed Web Apps || None || No access | | Installed Web Apps || None || No access || | ||
|- | |- | ||
| Privileged Web Apps || None || No access | | Privileged Web Apps || None || No access || | ||
|- | |- | ||
| Certified Web Apps || | | Certified Web Apps || | ||
Line 34: | Line 34: | ||
|| Implicit || Potential mitigations: Status indicator showing active bluetooth connection, user can click the status indicator to cancel the connection. Potentially limits on device types. | || Implicit || Potential mitigations: Status indicator showing active bluetooth connection, user can click the status indicator to cancel the connection. Potentially limits on device types. | ||
|} | |} | ||
=== Notes === | === Notes === |
Revision as of 12:47, 24 September 2012
Web Bluetooth API
Brief purpose of API: The aim of WebBluetooth is to establish a DOM API to set up and communicate with Bluetooth devices. This includes setting properties on adapters and devices, scanning for devices, bonding, and socket initialization for audio and communication.
General Use Cases:
Inherent threats: Privacy, access to sensitive user devices, de-anonimization based on bluetooth state
Threat severity: High
References:
- https://bugzilla.mozilla.org/show_bug.cgi?id=674737
- https://wiki.mozilla.org/WebAPI/WebBluetooth
- Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/ztmSvKP3Z8U/discussion
Permissions Table
Type | Use Cases | Authorization Model | Notes & Other Controls |
---|---|---|---|
Web Content | None | No access | |
Installed Web Apps | None | No access | |
Privileged Web Apps | None | No access | |
Certified Web Apps |
|
Implicit | Potential mitigations: Status indicator showing active bluetooth connection, user can click the status indicator to cancel the connection. Potentially limits on device types. |
Notes
Non-certified use cases are out of scope for 1.0. We will consider those for a subsequent release.