This distinction between user permission and general permission is key, I think.

For example, I could naively imagine something like the browser auto-granting 
permission if the requested remoteAddress is equal to the IP address of the 
origin executing the API. Possibly with a pre-flight request that checks e.g. 
/.well-known/tcp-udp-permission-port-<remotePort> on that origin for a header 
to ensure the server is cooperative. (But I am sure there are security people 
standing by to tell me how this is very naive...) The async permissions style 
is flexible enough to allow any such techniques to come in to play.

-----Original Message-----
From: Nilsson, Claes1 [mailto:claes1.nils...@sonymobile.com] 
Sent: Wednesday, April 1, 2015 09:58
To: 'Anne van Kesteren'
Cc: public-sysa...@w3.org; public-webapps; Device APIs Working Group; Domenic 
Denicola; slightly...@chromium.org; yass...@gmail.com
Subject: RE: [W3C TCP and UDP Socket API]: Status and home for this 
specification

Hi Anne,

This is a misunderstanding that probably depends on that I used the word 
"permission", which people associate with "user permission". User permissions 
are absolutely not enough to provide access to this API. However, work is 
ongoing in the Web App Sec WG that may provide basis for a security model for 
this API. Please read section 4, 
http://www.w3.org/2012/sysapps/tcp-udp-sockets/#security-and-privacy-considerations.
 

I am trying to get to a point to see if a TCP and UDP Socket is possible to 
standardize taking the changed assumption into consideration, i.e. there will 
be no W3C web system applications.

BR
  Claes


Claes Nilsson
Master Engineer - Web Research
Advanced Application Lab, Technology

Sony Mobile Communications
Tel: +46 70 55 66 878
claes1.nils...@sonymobile.com

sonymobile.com



> -----Original Message-----
> From: Anne van Kesteren [mailto:ann...@annevk.nl]
> Sent: den 1 april 2015 11:58
> To: Nilsson, Claes1
> Cc: public-sysa...@w3.org; public-webapps; Device APIs Working Group; 
> Domenic Denicola; slightly...@chromium.org; yass...@gmail.com
> Subject: Re: [W3C TCP and UDP Socket API]: Status and home for this 
> specification
> 
> On Wed, Apr 1, 2015 at 11:22 AM, Nilsson, Claes1 
> <claes1.nils...@sonymobile.com> wrote:
> > A webapp could for example request permission to create a TCP
> connection to a certain host.
> 
> That does not seem like an acceptable solution. Deferring this to the 
> user puts the user at undue risk as they cannot reason about this 
> question without a detailed understanding of networking.
> 
> The best path forward here would still be standardizing some kind of 
> public proxy protocol developers could employ:
> 
>   https://annevankesteren.nl/2015/03/public-internet-proxy
> 
> 
> --
> https://annevankesteren.nl/

Reply via email to