From f94fa4aed691b693f68b00f4b55b6c52edf8baa0 Mon Sep 17 00:00:00 2001 From: Mike Taylor Date: Thu, 28 Oct 2021 21:28:08 +0000 Subject: [PATCH] Editorial: Discuss how query() makes abuse harder to detect. (#306) SHA: 191a50a9069c7897b1e9a8aab96567c458d79c7a Reason: push, by @miketaylr Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- index.html | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/index.html b/index.html index e4ffeb3..49981d1 100644 --- a/index.html +++ b/index.html @@ -2223,6 +2223,17 @@

B.

C. Security and privacy considerations

This section is non-normative.

+

+ Web pages often run more- and less-trusted components as the same origin. For example, a + newspaper may run advertising code without sandboxing it into a cross-origin iframe. If the + newspaper has a legitimate reason to use a person's location, that also happens to grant + access to the less trusted advertiser. Without the query() function in this + specification, to read the person's location, an advertisement needs to risk showing a + prompt, which exposes it to detection. With this function, the advertisement can silently + track just the people who've already granted their location to the newspaper. The UA might + provide notice of when permissions are in use on a page which might increase the visibility + of abuse. +

An adversary could use a permission state as an element in creating a "fingerprint" corresponding to an end-user. Although an adversary can already determine the state of a @@ -2246,7 +2257,7 @@

C. [Exposed=(Window,Worker)] interface Permissions { - Promise<PermissionStatus> query(object permissionDesc); + Promise<PermissionStatus> query(object permissionDesc); }; dictionary PermissionDescriptor { @@ -2883,7 +2894,9 @@

F.2 Informative ref
  • § 4. Permissions interface
  • - § D. IDL Index + § C. Security and privacy considerations +
  • + § D. IDL Index