WebAPI Security Discussion:Network Information API

[Paul Theriault]

(Please reply-to dev-w...@lists.mozilla.org)

Name of API: Network Information API Sec
Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=677166
https://wiki.mozilla.org/WebAPI/NetworkAPI

Brief purpose of API:
General Use Cases:
Read current bandwidth estimate or ask if connection is metered

Listen for connection change events

Inherent threats: Privacy (de-anonymize users based on connection change
events?)

Threat severity:Low

== Regular web content (unauthenticated) ==
Use cases for unauthenticated code: Read current bandwidth estimate or
ask if connection is metered
Authorization model for normal content: Read current bandwidth estimate
or ask if connection is metered
Authorization model for installed content:
Potential mitigations: Maybe fuzz the exact time of the network change
event in a similar manner to idle API.

== Trusted (authenticated by publisher) ==
Use cases for authenticated code:As above
Use cases for trusted code:
Potential mitigations:

== Certified (vouched for by trusted 3rd party) ==
Use cases for certified code: As above
Authorization model:
Potential mitigations:

[Mounir Lamouri]

On 17/07/13 04:11, prskum...@gmail.com wrote:
> how can we use this api in an app? whats the permission i need to add in manifest file and how to find the bandwidth?

Hi,

This API is not implemented in Firefox OS.

--
Mounir