WebAPI/Security/Contacts

Name of API: Contacts API

References:

• https://wiki.mozilla.org/WebAPI/ContactsAPI
• https://groups.google.com/d/topic/mozilla.dev.webapps/hvG5PXsFyzw/discussion

Brief purpose of API: Access to users contacts.

General Use Cases:N/A

Inherent threats:

• Read/exfiltrate confidential information,
• Destroy user's contact data
• DoS via filling address book with bogus data

Threat severity: High

Regular web content (unauthenticated)

Use cases for unauthenticated code: Mediated access to specific (user selected) contact information

Authorization model for uninstalled web content: OS mediated (web activities, or trusted UI)

Authorization model for installed web content: OS mediated (web activities, or trusted UI)

Potential mitigations:

• App requests a contact via web activities or trusted UI
• API provides a local identifier instead of the actual contact information

Trusted (authenticated by publisher)

Use cases for authenticated code: Create, read or edit contact information

Authorization model: Explicit

Potential mitigations:

• Let user configure what data is accessible (globally?)
• Have separate permissions for read vs read&write, assuming that many apps only want read, and could use web activities to create a contact if necessary. These distinctions should not be exposed to the user (the user should be only be asked if the API wants to "have access to" the contacts API, as it adds too much cognitive overhead to start scanning dialogs for the verb without clearly differentiating the risk to the user).

Certified (vouched for by trusted 3rd party)

Use cases for certified code: Create, read or edit contact information

Authorization model: Implicit

Potential mitigations: None