WebAPI/Security/SMS
Name of API: Web SMS API
References: https://bugzilla.mozilla.org/show_bug.cgi?id=674725
Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/58a66963732b09a0/9ae97f65a9e74c78
Brief purpose of API: Send and receive SMS messages
General Use Cases: None
Inherent threats:
- Sending an SMS costs user money, premium SMS services, SMS payments etc
- Receiving SMS has privacy implications, SMS also used for 2-factor authentication
Threat severity: critical per https://wiki.mozilla.org/Security_Severity_Ratings
Regular web content (unauthenticated)
Use cases for unauthenticated code: App prompts user to send SMS
Authorization model for uninstalled web content: Explicit via web activities
Authorization model for installed web content: Explicit via web activities
Potential mitigations:
Privileged (approved by app store)
Use cases for privileged code: Full-featured SMS app. Read & send SMS.
Authorization model: Explicit
Potential mitigations:
- Set thresholds or warnings on premium numbers.
- Only allow sending of SMS's to user-provided contacts.
- Show OS confirmation of message before sending.
Certified (system-critical apps)
Use cases for certified code: SMS app
Authorization model: Implicit
Potential mitigations: None beyond certification
Notes
Should trusted apps be able to register as handlers for SMS web activities/intents, or only certified apps?