Reading through https://wicg.github.io/keyboard-map/#privacy the only risk here is increased fingerprinting surface. Is that correct? (aside - the privacy section states that the API is only available in top-level contexts. You probably want to change that)
On Thursday, October 14, 2021 at 10:09:04 PM UTC+2 snianu wrote: > *Can you clarify what the current situation is?* > > getLayoutMap() which is part of the Keyboard API can only be accessed in > the top browsing context which cuts off access from same and cross origin > iframes. > > With this permission policy based solution, the default value would be > “Self” that grants access to same origin iframe by-default, but requires > web authors to add the “keyboard-map” value to allow attribute in order to > grant access within cross-origin iframes. > > > > *IIUC, currently layout maps are not available at all to iframes. Is that > correct?* > > Correct. > > > > *Also, are you suggesting to add a permission policy that would enable it > by default for same-origin iframes, and enable explicit delegation for > cross-origin iframes?* > > Yes. > > > > -Anupam > > > > *From:* Yoav Weiss <[email protected]> > *Sent:* Thursday, October 14, 2021 12:29 PM > *To:* blink-dev <[email protected]> > *Cc:* Anupam Snigdha <[email protected]>; Bo Cupp <[email protected]>; > Scott Low <[email protected]>; [email protected] <[email protected] > > > *Subject:* [EXTERNAL] Re: Intent to Implement and Ship: Feature policy > for Keyboard API > > > > > > On Tuesday, October 12, 2021 at 12:33:19 AM UTC+2 snianu wrote: > > Contact emails > > [email protected] > > Explainer > > https://github.com/WICG/keyboard-map/issues/38 > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FWICG%2Fkeyboard-map%2Fissues%2F38&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487253429%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=u9j9NgIDjC6pvLdOAHF6vdxFEHZQzTuMnoFTZBQguXc%3D&reserved=0> > > Specification > > https://wicg.github.io/keyboard-map/#permissions-policy > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwicg.github.io%2Fkeyboard-map%2F%23permissions-policy&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487263414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Rj5MVTVoxriJAb13jGVB%2F2DKgn%2F%2FxiR7W5Z276Jnhkk%3D&reserved=0> > > Summary > > getLayoutMap() used in conjunction with code solves the problem of > identifying the actual key pressed in keyboard with different layout maps > such as English vs French keyboards, but since getLayoutMap() isn't > available in all contexts (can't be used inside iframes), Office web apps > like Excel, Word, PowerPoint, etc. that show up as embedded experiences in > Outlook Web, Teams, etc. and are running in iframes, can't use this API. > Adding keyboard-map to the allow attribute list solves this problem. > > > > Can you clarify what the current situation is? > > IIUC, currently layout maps are not available at all to iframes. Is that > correct? > > Also, are you suggesting to add a permission policy that would enable it > by default for same-origin iframes, and enable explicit delegation for > cross-origin iframes? > > > > See this > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FWICG%2Fkeyboard-map%2Fissues%2F38&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487263414%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=vnbYGkHsyzA%2F9IUI%2Bk4xfs8FGKyAi3Qjf2mKdiS81kE%3D&reserved=0> > > Github issue for more info. > > Blink component > > Blink > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.chromium.org%2Fp%2Fchromium%2Fissues%2Flist%3Fq%3Dcomponent%3ABlink&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487273403%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y%2FpUUHVQRI35%2BkL%2BqU0odfmWgM%2BrmkJl7yNmu2pFgg0%3D&reserved=0> > > Search tags > > keyboard-map > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.chromestatus.com%2Ffeatures%23tags%3Akeyboard-map&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487283398%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=nGANnc9bDdH1URCmYbujQHvgB8HU36vLSDnpxQOdJG8%3D&reserved=0> > , Keyboard > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.chromestatus.com%2Ffeatures%23tags%3AKeyboard&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487283398%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=5VzFt9uBcmCLzt%2BlJ9UUh1bCpQE%2B0Dq6xtMEtktgPfk%3D&reserved=0> > > TAG review > > Not applicable as this is API has been shipped. > > > > TAG review status > > Not applicable > > Risks Interoperability and Compatibility > > Currently Keyboard API is not supported on Safari and Firefox so interop > risk is minimal. Moreover, this proposal only allows the usage of the > Keyboard API inside an iframe if it's explicitly specified in the allow > attribute list by the web author. > > The feature policy names are based on the permission names, which have > been part of the permission policy spec > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fw3c.github.io%2Fwebappsec-permissions-policy%2F&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487293392%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=9%2FUOTocg8SXG4qUnxe5pArhcjCWvTt4mdnv3dhFwccc%3D&reserved=0> > . > > > > *Gecko*: Negative (https://github.com/mozilla/standards-positions/pull/310 > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fmozilla%2Fstandards-positions%2Fpull%2F310&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487293392%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=infujJEIQg8%2BKgtZB5WiLeHrJcE%2BcwrcoGFFoVuLLcA%3D&reserved=0> > ) > > *WebKit*: Negative ( > https://github.com/WICG/keyboard-map/issues/30#issue-487691188 > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FWICG%2Fkeyboard-map%2Fissues%2F30%23issue-487691188&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487303386%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=mL91VaMHZ5NUX%2B6mi8Vb5WbQ7bkDoR%2FotDgCoAu%2FUos%3D&reserved=0> > ) > > *Web developers*: Positive ( > https://github.com/WICG/keyboard-map/issues/38#issue-934823530 > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FWICG%2Fkeyboard-map%2Fissues%2F38%23issue-934823530&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487303386%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=nM4pCKj0DnEyAbTlEJoV0c3xzhmVgNUJKWEixBRwFEQ%3D&reserved=0> > ) > Ergonomics > > None. > Activation > > None. > Security > > While there are fingerprinting concerns, this API has been shipped in > Chrome 69 and adding to the allow attribute list (like HID, > clipboard-read/write etc) allows sites like Office web apps to use this > API. The default value would be "self" (= top-level browsing context) but > sites could add it to allow list to access within iframe context. > Debuggability > > The allow attribute has basic tooling support as described in this > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1eJn5QIX4JFGackDYmdLxWXEmTDkSGj_ZGz5XY4uCKbY%2Fedit&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487313385%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=2PmYRL8YaXeJa8JuqlV9C4OZ%2BYTje6weml5GCIhZc94%3D&reserved=0> > > doc. > Is this feature fully tested by web-platform-tests > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchromium.googlesource.com%2Fchromium%2Fsrc%2F%2B%2Fmaster%2Fdocs%2Ftesting%2Fweb_platform_tests.md&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487313385%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=I35MHf%2BtH1fBU6lKKmvkv6zhvzH8XSS2yxExYR7yvbk%3D&reserved=0> > ? > > Yes > Requires code in //chrome? > > False > > Tracking bug > > https://bugs.chromium.org/p/chromium/issues/detail?id=1258242 > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.chromium.org%2Fp%2Fchromium%2Fissues%2Fdetail%3Fid%3D1258242&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487323380%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=i3iLOUW1BS4lj7owh9RUX1kL%2FscozUUQpfhLzZMNnio%3D&reserved=0> > > Estimated milestones > > 97 > Link to entry on the Chrome Platform Status > > https://www.chromestatus.com/feature/5657965899022336 > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.chromestatus.com%2Ffeature%2F5657965899022336&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487333369%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=DubmlhmgQ6w9mm0yGQkCNbHwh5f%2FdkXajL9mc1hrGUQ%3D&reserved=0> > > This intent message was generated by Chrome Platform Status > <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.chromestatus.com%2F&data=04%7C01%7Csnianu%40microsoft.com%7C5ccc1536d0b24a7763e608d98f48d180%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637698367487333369%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=akbQm%2BGYEJGBjzbjualZD46xmgfy4B0r9clvTPMHQoQ%3D&reserved=0> > . > > > > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/294e0fe6-e963-4408-a8e5-de02d562532fn%40chromium.org.
