Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-12-20 Thread Anne van Kesteren
On Thu, Dec 20, 2012 at 8:08 AM, Maciej Stachowiak m...@apple.com wrote: On Dec 18, 2012, at 6:44 AM, Anne van Kesteren ann...@annevk.nl wrote: The specification is modeled after Gecko and Chrome and very much intents to have keyboard access working. As per usual, everything that is not

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-12-19 Thread Maciej Stachowiak
On Dec 18, 2012, at 6:44 AM, Anne van Kesteren ann...@annevk.nl wrote: On Tue, Oct 23, 2012 at 12:50 AM, Maciej Stachowiak m...@apple.com wrote: Based on all this, I continue to think that requesting keyboard access should involve separate API, so that it can be feature-detected and given

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-12-19 Thread Florian Bösch
On Thu, Dec 20, 2012 at 8:08 AM, Maciej Stachowiak m...@apple.com wrote: And given this difference in UA behavior, it seems useful to let web developers feature-detect the difference in behavior somehow. It would be useful to be able to detect it. But it's in no way cruical, we can just do

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-12-18 Thread Anne van Kesteren
On Tue, Oct 23, 2012 at 12:50 AM, Maciej Stachowiak m...@apple.com wrote: Based on all this, I continue to think that requesting keyboard access should involve separate API, so that it can be feature-detected and given different security treatment by vendors as desired. This is what Flash does,

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-22 Thread Chris Pearce
On 16/10/12 18:48, Maciej Stachowiak wrote: Many games could work with only non-alphanumeric keys or in some cases only the mouse. As could slideshows. You only need space/enter/arrows for a full screen slide presentation. FWIW I agree. Pretty much the only uses cases that I can envisage that

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-22 Thread Florian Bösch
FYI Flickr slideshows and Google street view are now fullscreen users. On Tue, Oct 23, 2012 at 12:04 AM, Chris Pearce cpea...@mozilla.com wrote: On 16/10/12 18:48, Maciej Stachowiak wrote: Many games could work with only non-alphanumeric keys or in some cases only the mouse. As could

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-22 Thread Maciej Stachowiak
On Oct 22, 2012, at 3:04 PM, Chris Pearce cpea...@mozilla.com wrote: This looks remarkably like Mozilla's original proposal: https://wiki.mozilla.org/Gecko:FullScreenAPI We chose not to implement this as it offers little protection against phishing or spoofing attacks that don't rely on

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-22 Thread Florian Bösch
On Tue, Oct 23, 2012 at 12:50 AM, Maciej Stachowiak m...@apple.com wrote: Based on all this, I continue to think that requesting keyboard access should involve separate API, so that it can be feature-detected and given different security treatment by vendors as desired. This is what Flash

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-22 Thread Rick Waldron
On Monday, October 22, 2012 at 6:04 PM, Chris Pearce wrote: On 16/10/12 18:48, Maciej Stachowiak wrote: Many games could work with only non-alphanumeric keys or in some cases only the mouse. As could slideshows. You only need space/enter/arrows for a full screen slide presentation.

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-20 Thread Feross Aboukhadijeh
: Vincent Scheib; Maciej Stachowiak; public-webapps@w3.org; Chris Pearce; Florian Bösch; Anne van Kesteren Subject: Re: Defenses against phishing via the fullscreen api (was Re: full screen api) On Tue, Oct 16, 2012 at 4:48 PM, Carr, Wayne wayne.c...@intel.com wrote: Chrome supports Fullscreen

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-20 Thread Feross Aboukhadijeh
...@gmail.com] *Sent:* Thursday, October 18, 2012 7:08 PM *To:* Feross Aboukhadijeh *Cc:* Carr, Wayne; Jonas Sicking; Vincent Scheib; Maciej Stachowiak; public-webapps@w3.org; Chris Pearce; Anne van Kesteren *Subject:* Re: Defenses against phishing via the fullscreen api (was Re: full screen api

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-19 Thread Florian Bösch
On Fri, Oct 19, 2012 at 4:50 AM, Carr, Wayne wayne.c...@intel.com wrote: If touch events are restricted, how does the user pause the video? If you do not disable click/touch on devices with an onscreen keyboard, how do you defend against phishing?

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-19 Thread Florian Bösch
On Fri, Oct 19, 2012 at 9:08 AM, Feross Aboukhadijeh fer...@feross.orgwrote: Apple has also indicated of not liking confirm prompts of any kind whatsoever To reiterate: for 90% (probably more) of fullscreen use cases, there would be no confirmation prompt at all. Only when the developer

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-18 Thread Florian Bösch
phishing via the fullscreen api (was Re: full screen api) On Tue, Oct 16, 2012 at 4:48 PM, Carr, Wayne wayne.c...@intel.com wrote: Chrome supports Fullscreen with keyboard enabled. We use a notification that persists until a user notices and dismisses it. We may modify it in the future

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-18 Thread Florian Bösch
Stachowiak; public-webapps@w3.org; Chris Pearce; Florian Bösch; Anne van Kesteren Subject: Re: Defenses against phishing via the fullscreen api (was Re: full screen api) On Tue, Oct 16, 2012 at 4:48 PM, Carr, Wayne wayne.c...@intel.com wrote: Chrome supports Fullscreen with keyboard

RE: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-18 Thread Carr, Wayne
Kesteren Subject: Re: Defenses against phishing via the fullscreen api (was Re: full screen api) Note that that's a related but not identical stage of the process. There will still have to be a way to differentiate how to request fullscreen with those capabilities that you queried as being being

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-17 Thread Jonas Sicking
On Tue, Oct 16, 2012 at 4:48 PM, Carr, Wayne wayne.c...@intel.com wrote: Chrome supports Fullscreen with keyboard enabled. We use a notification that persists until a user notices and dismisses it. We may modify it in the future to make this more noticeable, e.g. dimming page contents similar

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-17 Thread Rick Waldron
On Tue, Oct 16, 2012 at 5:42 AM, Florian Bösch pya...@gmail.com wrote: On Tue, Oct 16, 2012 at 7:48 AM, Maciej Stachowiak m...@apple.com wrote: What are the cases where webpage-driven (as opposed to browser-chrome-driven) fullscreen is really compelling, but they need full keyboard access

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-17 Thread Rick Waldron
On Wed, Oct 17, 2012 at 12:06 PM, Florian Bösch pya...@gmail.com wrote: On Wed, Oct 17, 2012 at 4:51 PM, Rick Waldron waldron.r...@gmail.comwrote: I'm not sure where this falls, but how would things like control-w or cmd-w work? If the non-alphanumerics work, but the alphanumerics do not...

RE: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-17 Thread Carr, Wayne
Scheib; Maciej Stachowiak; public-webapps@w3.org; Chris Pearce; Florian Bösch; Anne van Kesteren Subject: Re: Defenses against phishing via the fullscreen api (was Re: full screen api) On Tue, Oct 16, 2012 at 4:48 PM, Carr, Wayne wayne.c...@intel.com wrote: Chrome supports Fullscreen with keyboard

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-16 Thread Vincent Scheib
Chrome supports Fullscreen with keyboard enabled. We use a notification that persists until a user notices and dismisses it. We may modify it in the future to make this more noticeable, e.g. dimming page contents similar to FireFox. I personally think it would be unfortunate to support multiple

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-16 Thread Florian Bösch
On Tue, Oct 16, 2012 at 10:56 PM, Vincent Scheib sch...@google.com wrote: However, if other browsers only implement fullscreen without keyboard support then clearly it would be best if developers could detect this when composing their application interface, avoiding prompting users to enter

RE: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-16 Thread Carr, Wayne
to the notification.) From: Vincent Scheib [mailto:sch...@google.com] Sent: Tuesday, October 16, 2012 1:57 PM To: Maciej Stachowiak Cc: Chris Pearce; Florian Bösch; Anne van Kesteren; Carr, Wayne; public-webapps@w3.org Subject: Re: Defenses against phishing via the fullscreen api (was Re: full screen api

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-15 Thread Maciej Stachowiak
On Oct 14, 2012, at 3:54 PM, Chris Pearce cpea...@mozilla.com wrote: On 14/10/12 00:49, Maciej Stachowiak wrote: Despite both of these defenses having drawbacks, I think it is wise for implementations to implement at least one of them. I think the spec should explicitly permit

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-15 Thread Florian Bösch
Ok, so here's my question. You have a webapp (that oh, happens to be a game, or a slideshow app, or a video player with controls, etc.) which needs keyboard/UI events access to work (come to think of it, can you honestly think of any sort of usecase that does work entirely without user

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-15 Thread Maciej Stachowiak
That's why I liked having a separate API to request fullscreen with full alphanumeric keyboard access. This allows apps to determine if fullscreen with keyboard is available on a given browser, and allows browsers to set separate security policies for that case. I think the spec should change

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-15 Thread Florian Bösch
A function to query the capabilities obtainable after entering fullscreen would also work from an application developers point of view: navigator.fullscreenCapability.keyboard - true/false navigator.fullscreenCapability.mouse - true/false navigator.fullscreenCapability.ui - true/false

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-15 Thread Maciej Stachowiak
On Oct 15, 2012, at 5:01 PM, Chris Pearce cpea...@mozilla.com wrote: On 16/10/12 11:39, Maciej Stachowiak wrote: That's why I liked having a separate API to request fullscreen with full alphanumeric keyboard access. This allows apps to determine if fullscreen with keyboard is available

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-14 Thread Chris Pearce
On 14/10/12 00:49, Maciej Stachowiak wrote: On Oct 13, 2012, at 1:49 AM, Anne van Kesteren ann...@annevk.nl wrote: On Fri, Oct 12, 2012 at 8:25 PM, Florian Bösch pya...@gmail.com wrote: There was a limited discussion on that a few days ago with the limited consensus (?) being that requiring

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-13 Thread Florian Bösch
On Sat, Oct 13, 2012 at 1:49 PM, Maciej Stachowiak m...@apple.com wrote: I think the most effective defense against phishing via fullscreen is to prevent keyboard access. The original design for requestFullscreen had an optional argument for requesting keyboard access, which led to a warning

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-13 Thread Maciej Stachowiak
On Oct 13, 2012, at 4:58 AM, Florian Bösch pya...@gmail.com wrote: On Sat, Oct 13, 2012 at 1:49 PM, Maciej Stachowiak m...@apple.com wrote: I think the most effective defense against phishing via fullscreen is to prevent keyboard access. The original design for requestFullscreen had an

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-13 Thread Florian Bösch
You're making fullscreen useless for games. On Sat, Oct 13, 2012 at 9:56 PM, Maciej Stachowiak m...@apple.com wrote: On Oct 13, 2012, at 4:58 AM, Florian Bösch pya...@gmail.com wrote: On Sat, Oct 13, 2012 at 1:49 PM, Maciej Stachowiak m...@apple.com wrote: I think the most effective

Re: Defenses against phishing via the fullscreen api (was Re: full screen api)

2012-10-13 Thread Florian Bösch
WebGL FPSes with fullscreen support - http://media.tojicode.com/q3bsp/ - https://developer.mozilla.org/en-US/demos/detail/bananabread - http://dl.dropbox.com/u/6873971/data/cube2/index.html On Sat, Oct 13, 2012 at 9:58 PM, Florian Bösch pya...@gmail.com wrote: You're making fullscreen useless