Re: WebAPI meta: permission prompts considered harmful

2012-04-24 Thread Adrienne Porter Felt
On Fri, Apr 20, 2012 at 11:13 AM, Mounir Lamouri wrote: > On 04/20/2012 10:58 AM, Adrienne Porter Felt wrote: > > You can theoretically use Intents to send something silently in the > > background, or you can use Intents to open a full-screen SMS dialog that > is > > pre-populated where the user

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Randell Jesup
[Grrr. Silly tbird messing up quotes below... Resent because direct posting from Emacs/Gnus keeps getting flagged as needing moderator approval] >There _is_ a more powerful capability that we may want to have available to >a small handful of apps: "turn on the camera at some indefinite time

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Randell Jesup
[Grrr. Silly tbird messing up quotes below... Resent because direct posting from Emacs/Gnus keeps getting flagged as needing moderator approval] >There _is_ a more powerful capability that we may want to have available to >a small handful of apps: "turn on the camera at some indefinite time

NSS java.lang.UnsatisfiedLinkError on windows 2003

2012-04-24 Thread Guy Itzhaki
Dear forum, I'm using nss 3.12.4 to establish fips compliance SSL connection. As first step, in my java application I load (using System.load()) libnspr4, libplc4, libplds4, nssutil3, sqlite3. In win xp and win7 it works fine, the dlls are loaded and I managed to create fips compliance certificate

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Randell Jesup
On 4/17/2012 9:00 PM, Lucas Adamski wrote: On 4/15/2012 1:32 PM, Adrienne Porter Felt wrote: Would the following suggestion solve the problem? * Applications may embed the "magic" photo or videorecord icons. As soon as the user presses the button, the app receives the data. A notification is

Re: [b2g] WebAPI Security Discussion: Camera API

2012-04-24 Thread Randell Jesup
On 4/16/2012 11:14 AM, Jason Miller wrote: That is one area where one could trust the app - the only way for it to gain access to the camera would be to insert the button's DOM node facade (this is a secure mechanism, because the DOM node is not the button itself, it is only a placement indicator

Re: [b2g] WebAPI Security Discussion: Web Telephony

2012-04-24 Thread Randell Jesup
>Some followup issues that came up in conversation: > >1. There is a regulatory frame around E-911 that we need to understand. > Do we need to indicate, through the API, that a device can be used > for 911 calls but not other calls? And don't forget that the regulatory issues are quite diffe

NSS java.lang.​Unsatisfie​dLinkError on windows 2003

2012-04-24 Thread Guy Itzhaki
Dear forum, I'm using nss 3.12.4 to establish fips compliance SSL connection. As first step, in my java application I load (using System.load()) libnspr4, libplc4, libplds4, nssutil3, sqlite3. In win xp and win7 it works fine, the dlls are loaded and I managed to create fips compliance certifi

Re: [b2g] WebAPI Security Discussion: Camera API

2012-04-24 Thread Randell Jesup
>Actually, a lot of apps need access to the preview before starting to >capture (an image or video). Any app that wants to do realtime >transformations or effects will need the preview stream and then >display it themselves. Also, there are a class of apps that do >"pre-cording" so that you can c

Re: [b2g] WebAPI Security Discussion: Web Telephony

2012-04-24 Thread Randell Jesup
>Some followup issues that came up in conversation: > >1. There is a regulatory frame around E-911 that we need to understand. > Do we need to indicate, through the API, that a device can be used > for 911 calls but not other calls? And don't forget that the regulatory issues are quite diffe

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Randell Jesup
>The countdown annoyance could also be mitigated by adding an "always allow" >option to the user countdown indicator or recording notification UI. That >way a user can grant her favorite alternative Camera application persisted >access to immediate stream access. Those two concepts combined solve

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Zack Weinberg
On 2012-04-24 9:50 AM, Randell Jesup wrote: >a small handful of apps: "turn on the camera at some indefinite time in the >future, without user interaction at the time". That need is exactly what some WebRTC apps need (think VoIP-like service - replacement for Skype, Google Hangouts where you w

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Adrienne Porter Felt
> > >There _is_ a more powerful capability that we may want to have available > to > >a small handful of apps: "turn on the camera at some indefinite time in > the > >future, without user interaction at the time". The only use case I can > >think of for that is an anti-device-theft system (turn on

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Serge Egelman
We thought about this (it's in the proposal that we're currently writing up), and there is no optimal solution. Implicit access through trusted UI works for *most* use cases, but there is a special set of edge cases---mostly security apps---that require permission for future events where the user

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Randell Jesup
[Grrr. Resent because direct posting from Emacs/Gnus keeps getting flagged as needing moderator approval. Re-resent to mailing list because posting to the newsgroup from thunderbird went into a black hole...] >There _is_ a more powerful capability that we may want to have available to >a small

Re: WebAPI Security Discussion: Camera API

2012-04-24 Thread Adrienne Porter Felt
I spent yesterday afternoon playing around with a lot of the most-popular iOS camera apps. Most of the special effects applied to previews are extremely simple: they change the contrast, blur everything but the center, shade everything but the center, etc. It would be pretty simple to write these