Re: [b2g] Removing

2015-09-14 Thread Anders Rundgren
On Monday, September 14, 2015 at 8:43:25 AM UTC+2, Paul Theriault wrote: > is not implemented on FxOS. > > > > On 12 Sep 2015, at 11:52 am, Anders Rundgren > > <anders.rundgren@gmail.com> wrote: > > > > This is not only related to Firefox OS. &g

[b2g] Removing

2015-09-11 Thread Anders Rundgren
This is not only related to Firefox OS. Google and Mozilla is apparently planning to remove where Google's position is that the classic x.509 use-case is invalid on the Web for privacy, security, and usability-reasons. This position is out of proportion since the (real-world) privacy problems

[b2g] Mozilla's plan to implement Native Messaging

2015-09-11 Thread Anders Rundgren
https://wiki.mozilla.org/WebExtensions#Additional_APIs Native Messaging is a great concept but the current solution is only a crude "workaround". ___ dev-b2g mailing list dev-b2g@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-b2g

Re: [b2g] Addons for FirefoxOS

2015-06-23 Thread Anders Rundgren
On Tuesday, June 23, 2015 at 1:22:03 AM UTC+2, Jonas Sicking wrote: Hi All, We've been talking about addons for FirefoxOS for a while. I'd like to make it more concrete what we want these addons to be able to do. An add-on that is high on the wish-list in the Android community is the ability

Re: [b2g] Aligning on an App Model for the future

2015-04-25 Thread Anders Rundgren
On Friday, April 24, 2015 at 5:49:25 PM UTC+2, Peter Dolanjski wrote: As an update, I've created a wiki for the summarized app types here: https://wiki.mozilla.org/Gaia/App_Definitions#App_Types_Proposal Please let me know if you disagree with anything as this will be used as the basis for

Re: [b2g] Fizz - Google project for powering the Web

2015-04-21 Thread Anders Rundgren
to FFOS, especially the first 3 at least. Not familiar with a similar API to Geofencing, but the others are definitely available to us. On 21 April 2015 at 13:21, Anders Rundgren anders.ru...@gmail.com wrote: http://www.cnet.com/news/with-fizz-google-hopes-to-bring-new-power-to-mobile-web

[b2g] Fizz - Google project for powering the Web

2015-04-21 Thread Anders Rundgren
http://www.cnet.com/news/with-fizz-google-hopes-to-bring-new-power-to-mobile-web/ I think this all wrong. DUPLICATING the native layer in the Open Web only creates gigantic standardization efforts and poor user interfaces due to mismatching security and privacy models. COMBINING these layers

Re: [b2g] New security model without package (was: Re: Rethink Hosted Packaged App)

2015-04-18 Thread Anders Rundgren
like we currently do with QR-code. However, the CONNECTING party certainly doesn't need to have a WebOS to use that in similarity to any other NFC use-case I'm aware of! Anders Web + Native = Killer Combination Tim On Sat, Apr 18, 2015 at 6:16 PM, Anders Rundgren anders.rundgren

Re: [b2g] New security model without package (was: Re: Rethink Hosted Packaged App)

2015-04-18 Thread Anders Rundgren
and comparable to its native (and currently much more powerful) cousin! Sorry for being a PITA but this is dead serious. Anders Rundgren ___ dev-b2g mailing list dev-b2g@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-b2g

[b2g] Web NFC Interface Proposal

2015-04-13 Thread Anders Rundgren
https://cyberphone.github.io/openkeystore/resources/docs/webnfc--web2device-bridge.pdf ___ dev-b2g mailing list dev-b2g@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-b2g

Re: [b2g] Service like apps

2015-03-25 Thread Anders Rundgren
On Tuesday, March 24, 2015 at 1:14:26 AM UTC+1, Dave Huseby wrote: Paul and I were discussing this in the context of the proposed crypto-ish hardware framework. I'm replying here to get some more eyes on what we discussed. Using apps to provide services via IAC of some form is a good

Re: [b2g] Apps and Sensitive APIs

2015-03-17 Thread Anders Rundgren
If you take a peek in https://code.google.com/p/chromium/issues/detail?id=378566 you will note that popular services like Spotify and Dropbox depend on bypassing the browser through a non-standard and troubled extension-scheme. ___ dev-b2g mailing

Re: [b2g] Apps and Sensitive APIs

2015-03-17 Thread Anders Rundgren
On Tuesday, March 17, 2015 at 7:06:21 AM UTC+1, Anders Rundgren wrote: If you take a peek in https://code.google.com/p/chromium/issues/detail?id=378566 you will note that popular services like Spotify and Dropbox depend on bypassing the browser through a non-standard and troubled extension

Re: [b2g] Apps and Sensitive APIs

2015-03-14 Thread Anders Rundgren
On Tuesday, March 10, 2015 at 1:24:18 AM UTC+1, Jonas Sicking wrote: (Sorry to change from dev-webapi to dev-b2g, but I think dev-b2g is better given the size of these changes). On Wed, Feb 4, 2015 at 4:49 AM, Benjamin Francis bfran...@mozilla.com wrote: One potential answer is that:

Re: [b2g] Apps and Sensitive APIs

2015-03-13 Thread Anders Rundgren
Hi Jonas, The subject you brought up is IMO the #1 question not only for Mozilla but for the Web at large. I think my recently updated document http://webpki.org/papers/web2native-bridge.pdf pretty well describes ONE way ahead which essentially is a Semi-Open Web. Although the document is

Re: [b2g] Granting Permissions to the Web

2015-02-22 Thread Anders Rundgren
On Thursday, February 19, 2015 at 9:19:40 AM UTC+1, Anne van Kesteren wrote: On Wed, Feb 18, 2015 at 7:16 PM, James Burke jrbu...@gmail.com wrote: Mobile use is really large. Native mobile apps do not have restrictions from these APIs. As indicated most don't need them either. If web

Re: [b2g] Mozilla's quest for the Holy Grail

2015-02-19 Thread Anders Rundgren
On Thursday, February 19, 2015 at 8:31:36 AM UTC+1, Anders Rundgren wrote: On Thursday, February 19, 2015 at 4:25:23 AM UTC+1, Anders Rundgren wrote: If I were Mozilla I would call off the quest for the Holy Grail (the open portable web), because: 1) It probably doesn't exist 2

Re: [b2g] Mozilla's quest for the Holy Grail

2015-02-18 Thread Anders Rundgren
On Thursday, February 19, 2015 at 4:25:23 AM UTC+1, Anders Rundgren wrote: If I were Mozilla I would call off the quest for the Holy Grail (the open portable web), because: 1) It probably doesn't exist 2) It is incompatible with the non-FFOS world which have no problems whatsoever writing

Re: [b2g] Running trusted code in the untrusted web - A writeup

2015-02-17 Thread Anders Rundgren
On Tuesday, February 17, 2015 at 2:17:18 PM UTC+1, Benjamin Francis wrote: On 17 February 2015 at 05:32, Anders Rundgren anders.ru...@gmail.com wrote: iframe trustedapp=com.example.PaymentRequest ... /iframe iframe mozapp=app://myapp.com .../iframe This code should appear

Re: [b2g] Running trusted code in the untrusted web - A writeup

2015-02-17 Thread Anders Rundgren
On Tuesday, February 17, 2015 at 4:13:43 PM UTC+1, Anders Rundgren wrote: On Tuesday, February 17, 2015 at 2:17:18 PM UTC+1, Benjamin Francis wrote: On 17 February 2015 at 05:32, Anders Rundgren anders.ru...@gmail.com wrote: iframe trustedapp=com.example.PaymentRequest ... /iframe

[b2g] Running trusted code in the untrusted web - A writeup

2015-02-16 Thread Anders Rundgren
https://lists.w3.org/Archives/Public/public-webapps/2015JanMar/0644.html ___ dev-b2g mailing list dev-b2g@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-b2g

Re: [b2g] Deprecating W3C SysApps

2015-02-11 Thread Anders Rundgren
On Wednesday, February 11, 2015 at 3:17:36 PM UTC+1, Benjamin Francis wrote: On 11 February 2015 at 05:02, Anders Rundgren anders.ru...@gmail.com wrote: Although it is cool standardizing interfaces to various device resources, it comes at a price in terms of slowness and inflexibility

[b2g] Deprecating W3C SysApps

2015-02-10 Thread Anders Rundgren
Although it is cool standardizing interfaces to various device resources, it comes at a price in terms of slowness and inflexibility. Recently Google publicly declared that they were not going to continue with SysApps which IMO spelled death of this effort. Since Apps using these APIs must be

Re: [b2g] Granting Permissions to the Web

2015-02-10 Thread Anders Rundgren
On Tuesday, February 10, 2015 at 11:52:55 AM UTC+1, Julien Wajsberg wrote: Hey Paul, Le 09/02/2015 12:41, Paul Theriault a écrit : === SMS === SMS is risky mainly due to the cost involved. Risks include cost of sending SMS and also SMS are very sensitive - e.g. often used in 2-factor

Re: [b2g] Calling Native Applications from the Web

2015-02-09 Thread Anders Rundgren
On Monday, February 9, 2015 at 12:45:16 PM UTC+1, pther...@mozilla.com wrote: On Monday, February 9, 2015 at 5:56:09 PM UTC+11, Anders Rundgren wrote: This discussion is related to the discussion Can web deprecate packaged apps which I didn't really saw the conclusion to. https

[b2g] Calling Native Applications from the Web

2015-02-08 Thread Anders Rundgren
This discussion is related to the discussion Can web deprecate packaged apps which I didn't really saw the conclusion to. https://lists.w3.org/Archives/Public/public-web-intents/2015Feb/.html I have received information from a Mozilla architect who claims that Mozilla is looking into this.

Re: [b2g] Future of packaged apps

2014-11-11 Thread Anders Rundgren
On Thursday, September 11, 2014 12:55:58 AM UTC+2, Jonas Sicking wrote: On Wed, Sep 10, 2014 at 12:16 PM, Ben Francis bfran...@mozilla.com wrote: It seems that the W3C proposal is incompatible with arguably the main use case of packaged apps in Firefox OS, which is the cryptographic signing

Re: [b2g] The SIM-card is about to die

2014-10-21 Thread Anders Rundgren
On Monday, October 20, 2014 7:47:57 AM UTC+2, Fabrice Desré wrote: Hi Anders, On 10/19/2014 09:53 PM, Anders Rundgren wrote: http://www.theverge.com/2014/10/16/6990525/the-sim-card-is-about-to-die That banks, governments and enterprises cannot use the SIM for storing

Re: [b2g] The SIM-card is about to die

2014-10-21 Thread Anders Rundgren
On Tuesday, October 21, 2014 6:41:16 PM UTC+2, Fabrice Desré wrote: On 10/21/2014 08:53 AM, Anders Rundgren wrote: I was rather thinking about the SE API. mozPay is another thing which unfortunately is hampered by the limitations of NSS. Why is NSS limiting for mozPay

Re: [b2g] The SIM-card is about to die

2014-10-19 Thread Anders Rundgren
On Monday, October 20, 2014 6:59:17 AM UTC+2, Kyle Huey wrote: On Sun, Oct 19, 2014 at 9:53 PM, Anders Rundgren anders.rundgren@gmail.com wrote: So this is yet another strong argument for dumping NSS as the core... This is not the right place for this discussion. You should

[b2g] The SIM-card is about to die

2014-10-19 Thread Anders Rundgren
http://www.theverge.com/2014/10/16/6990525/the-sim-card-is-about-to-die That banks, governments and enterprises cannot use the SIM for storing authentication keys made Apple and Google bypass the SIM. I.e. building payment solutions around the SIM which Mozilla is currently doing is not

Re: [b2g] Time to dump NSS

2014-10-11 Thread Anders Rundgren
On Friday, October 10, 2014 7:41:38 AM UTC+2, Anders Rundgren wrote: IMO, you can't build a modern mobile OS using a cryptographic platform which is 20 years old. NSS was designed when externally provisioned smart cards were [anticipated to be] the norm. Modern mobile OSes

[b2g] Time to dump NSS

2014-10-09 Thread Anders Rundgren
IMO, you can't build a modern mobile OS using a cryptographic platform which is 20 years old. NSS was designed when externally provisioned smart cards were [anticipated to be] the norm. Modern mobile OSes have embedded security hardware which NSS's cousin keygen doesn't address in a useful

[b2g] The TPM is dead, long live the TEE!

2014-07-14 Thread Anders Rundgren
In spite of Microsoft, Intel and Nokia betting the house on TPMs (Trusted Platform Modules), all their competitors in the mobile space including Google and Apple, have rather settled on embedded TEE (Trusted Execution Environment) schemes like this:

Re: [b2g] Emulator performance in a VM, X86 version

2014-04-01 Thread Anders Rundgren
On Tuesday, April 1, 2014 8:02:01 PM UTC+2, Gabriele Svelto wrote: Unfortunately, it turned out that performance was way below what could be practically useful. Inputting text takes like 10-20 seconds per character... Q: Is this to be expected? That's surprisingly slow.

Re: [b2g] Mobile Banking / Revising the FirefoxOS Keystore

2014-03-26 Thread Anders Rundgren
On Tuesday, March 25, 2014 9:47:48 AM UTC+1, Julien Wajsberg wrote: Le 25/03/2014 06:44, Anders Rundgren a écrit : As I understand Firefox OS reuses the Firefox desktop infrastructure for dealing with client keys (X.509 certificates). Although practical this part was designed 1995

[b2g] Mobile Banking / Revising the FirefoxOS Keystore

2014-03-24 Thread Anders Rundgren
As I understand Firefox OS reuses the Firefox desktop infrastructure for dealing with client keys (X.509 certificates). Although practical this part was designed 1995 and doesn't really match any serious usage including mobile banking.