Re: [rtcweb] Notes on security for browser-based screen/application sharing

[Ron <[e-mail]>]

On Fri, Mar 22, 2013 at 01:50:37PM +0000, Cullen Jennings (fluffy) wrote:
> 
> One comment on this from a requirements point of view…
> 
> Clearly sharking the "desktop" has far more security concerns that sharing a
> single applications such as PowerPoint. All the use cases I am interested in
> only need to share an application not a desktop. I think we should separate
> the handling of permissions along these lines. So I would be fine with "share
> desktop" needed an explicit grant of permission every time it was invoked
> (preferably by the user selecting this as part to choosing what to share in a
> browser chrome window). On the other hand, when sharing an application I
> might be OK with a persistent permission based on an install model but when I
> think about the real uses cases, I'm not sure that is needed if we have a
> good browser based dialog box to pick what will be shared. 
> 
> When the applications being shared is the browser there are also the
> additional problems as you point out. My view of the best way to solve these
> would be to scope the "application" being shared to the origin. What I mean
> by this is assume that I have my browser open to two webpages, one with an
> origin of gmail.com and the other to github.com and I am also running
> powerpoint and word. When the browser pops up a dialog box asking me what I
> wanted to share, it would give me 5 choices "Firefox (Gmail.com)", "Firefox
> (github.com), "Word", "PowerPoint", and "Everything" and let me pick. 

Do you really only have 2 browser tabs and 5 things running on your computer?

If it was to offer me something like that on the machine I'm typing on right
now (which is the one I'd be most likely to want to share something on if I
did), then browser tabs alone would give me a few hundred checkboxes, and if
we add my entire desktop and all the things running on it, then we're well
into Over 9000 territory ...   and I'm not sure I'd _want_ my browser to have
easy access to those things anyway, at least not without a whole lot of clear
opt-in and easy opt-back-out-again going on.

If I was to say I wanted to share my PDF reader, would I really want to share
all of the many dozens of documents currently open in it with a single checkbox?
What is the 'origin' for those if they're all cached on my local disk?

I'm not saying you aren't sort of on the right track here, but that's a data
point for a real world system ...

  Ron