From 11a67235dfd67b9cf7309b53b5942c1aaecdab1e Mon Sep 17 00:00:00 2001 From: Simon Hangl Date: Mon, 5 Aug 2024 13:55:05 +0000 Subject: [PATCH] Refined privacy and security considerations --- index.html | 109 +++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 76 insertions(+), 33 deletions(-) diff --git a/index.html b/index.html index 8630938..223f619 100644 --- a/index.html +++ b/index.html @@ -282,41 +282,84 @@

Permissions Policy Integration

-
+
+

- Privacy Indicator Requirements + Privacy & Security Considerations

-

- References in this specification to [[\devicesLiveMap]], and - [[\devicesAccessibleMap]] refer to the - definitions already created to support Privacy Indicator Requirements for - {{MediaDevices/getDisplayMedia()}}. -

-

- This specification extends the - Privacy Indicator Requirements of - {{MediaDevices/getDisplayMedia()}} to include {{MediaDevices/getAllScreensMedia()}}. - In addition to these requirements, user agents MUST - ensure that privacy indicators are visible at all times and that dismissal of the indicators - must not be persisted. The privacy indicators must inform about the origin - of the application capturing the screens. The indicators MUST clearly inform the user that the - monitors are captured. - Only the user may dismiss the privacy indicator. - The indicators MUST remain active for at five seconds, even if the capturing is ended earlier. -

-

- The user agents MUST provide the user with - the means to look up whether any origin - is allowed to call {{MediaDevices/getAllScreensMedia()}}. - The user agents MUST further provide the user - with information on the implications thereof. -

-

- The user agents MUST notify the user that - capturing may happen in the future if {{MediaDevices/getAllScreensMedia()}} - is enabled. The notification must be shown before sensitive browser content - can be exposed, e.g. on user login. -

+ +
+

+ Privacy Considerations & Usage Rndicator Requirements +

+

+ References in this specification to [[\devicesLiveMap]], and + [[\devicesAccessibleMap]] refer to the + definitions already created to support Privacy Indicator Requirements for + {{MediaDevices/getDisplayMedia()}}. +

+

+ This specification extends the + Privacy Indicator Requirements of + {{MediaDevices/getDisplayMedia()}} to include {{MediaDevices/getAllScreensMedia()}}. + In addition to these requirements, user agents MUST + ensure that privacy indicators are visible at all times and that dismissal of the indicators + must not be persisted. The privacy indicators must inform about the origin + of the application capturing the screens. The indicators MUST clearly inform the user that the + monitors are captured. + Only the user may dismiss the privacy indicator. + The indicators MUST remain active for at least five seconds, even if the capturing is ended earlier to prevent + applications from capturing the screens without the user noticing. +

+

+ The user agents MUST provide the user with + the means to look up whether any origin + is allowed to call {{MediaDevices/getAllScreensMedia()}}. + The user agents MUST further provide the user + with information on the implications thereof. +

+

+ The user agents MUST notify the user that + capturing may happen in the future if {{MediaDevices/getAllScreensMedia()}} + is enabled. The notification must be shown before sensitive browser content + can be exposed, e.g. on user login. A user agent + MUST ensure that the administrator changes the allow-list while + the user is viewing senstive browser content. +

+
+ +
+ + This section is non-normative. + +

Security Considerations

+ This sections discusses the major threats and mitigations. + +

Threat: Cross-site scripting

+ Attackers might use cross-site scripting to get access to sensitive information by using elevated permissions + of the allowlisted apps. + +
Mitigation
+ The API is exposed in isolated contexts (i.e. in isolated web apps) only. Isolated web apps are intended to mitigate + client-side cross-site scripting attacks by enforcing strict Content-Security-Policy + and {{TrustedType}} and server-side cross-site scripting attacks by bundling and signing of the app. + +

Threat: Violation of organization policies

+ Use of the API may violate organization policies, that control which apps should have access to sensitive information. + +
Mitigation
+ User agents must restrict the use of the API based on allowlists defined by the organization's administrator. + +

Threat: Third-party iframes initiating screen capture

+ Third party iframes might initiate screen capture. + +
Mitigation
+ The "all-screens-capture" permissions policy will control access, preventing third-party use by default. + To further safeguard from potential third-party attacks, isolated web apps employ a strict + Content-Security-Policy that makes using external resources + (i.e. the ones not originating from the Web Bundle itself) difficult and enforce cross-origin-isolation. +
+