1017485 - B2G NFC: Enable P2P Listening mode only when screen is on and unlocked.

Status: RESOLVED FIXED

(Firefox OS Graveyard :: NFC, defect)

Description

[Dimi Lee [:dimi]]

After landing bug 984207. NFC is always in listening mode, but we should not listen to p2p connection when screen is off.
 
And we need to define if we allowed listening to p2p when screen is on and locked.
If yes, we will require a new API(maybe just an additional config value ) for nfcd to distinguish screen off & locked and screen on & locked

Comment 1

[Dimi Lee [:dimi]]

Hi Wesley,
  Could you help confirm this ?

Comment 2

[Wesley Huang [:wesley_huang] (EPM) (NI me)]

What I understand is p2p sharing wouldn't be trigger while screen is off.
Juwei may be the right person to re-confirm.

Comment 3

[Junichi Hashimoto]

I think off-screen p2p has grate opportunities.

However, if the restriction is mandatory, nfcd should not take care screen-state directory.
how about providing API to filter techtype?

Comment 4

[Dimi Lee [:dimi]]

(In reply to Wesley Huang [:wesley_huang] from comment #2)
> What I understand is p2p sharing wouldn't be trigger while screen is off.
> Juwei may be the right person to re-confirm.

The question also includes the behavior when - "Screen ON and Locked"

Comment 5

[Ken Chang[:kenkai]]

NFC isn't allowed to p2p as well when screen is on and locked.

Comment 6

[Juwei Huang[:juwei]]

Yes. P2P sharing only available when screen in on.

Comment 8

[Stephanie Ouillon [:arroway] (needinfo me)]

For security reasons, P2P sharing shouldn't be available when the lockscreen is on, whatever the state of the screen. E.g.:
- the phone is in your pocket or in your bag in the locked mode and the screen inadvertently turned on. Whoever comes closer to you can potentially upload some data.
- your phone is locked on the side of your desk (at the office, on a coffee shop...), you don't pay attention thinking nobody will be able to access the content of your phone, but somebody taps his phone on yours and upload a malicious link.

The issue there is that the link will automatically be displayed on the browser without the user being prompted. This means a malicious script could execute in the browser for instance.
The only way we can ensure the user is (probably) aware of the transaction is having him/her unlocking the phone.

Comment 9

[Stephanie Ouillon [:arroway] (needinfo me)]

(and the screen is on)

Comment 10

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Update Summary, should we allow P2P listening when screen is off (and not locked) is TBD.

Comment 11

[Dimi Lee [:dimi]]

Attachment: pull request to platofrm_system_nfcd v1

Comment 12

[Dimi Lee [:dimi]]

Attachment: pull request to mozilla-b2g/platform_system_nfcd v2

Modify bug description.

Comment 13

[Dimi Lee [:dimi]]

It works in flame. Mark checkin-needed

Comment 14

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

https://github.com/mozilla-b2g/platform_system_nfcd/commit/dd72bacb432efc5135a1f747d00aab91f898bddb

Comment 15

[Dimi Lee [:dimi]]

Attachment: [2.0] pull request to mozilla-b2g/platform_system_nfcd

Comment 16

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

merge in v2.0 branch
https://github.com/mozilla-b2g/platform_system_nfcd/commit/6632331bba90fae08af0baba884527027f6589cd