1085653 - Privacy-Technical Review: Firefox Encrypted Media Extensions (EME)

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Chris Peterson [:cpeterson]]

EME project wiki:
https://wiki.mozilla.org/Media/EME

EME privacy review wiki:
https://wiki.mozilla.org/Privacy/Reviews/Encrypted_Media_Extensions

Comment 1

[Chris Peterson [:cpeterson]]

Curtis: who should I work with to continue the EME privacy review? dveditz?

Comment 2

[Curtis Koenig [:curtisk (non-Moz)]]

I've no idea if dveditz will do this as he's not done it in the past. It went from Sid to me and afaik noone else has done PTR

Comment 3

[Chris Peterson [:cpeterson]]

These bugs are necessary for vouching and sandboxing a third-party CDM.

Comment 5

[Chris Peterson [:cpeterson]]

Marshall, what are the next steps for the EME Privacy Review?

I am following up with an engineer about a security review of the CDM sandbox.

Comment 6

[Merwin]

Hi Chris,

I believe when last we spoke, we had talked about having an EME privacy UI.  Can you give me an update on that? I think if that has progressed, then there isn't any further action regarding the privacy review and this can be closed out.

Marshall

Comment 7

[Chris Peterson [:cpeterson]]

(In reply to merwin from comment #6)
> I believe when last we spoke, we had talked about having an EME privacy UI. 
> Can you give me an update on that? I think if that has progressed, then
> there isn't any further action regarding the privacy review and this can be
> closed out.

Yes. Sorry, it's been a while since our meeting. :)

jwwang updated Firefox's "Clear Recent History" (bug 1111788) and "Forget This Site" (bug 1111787) commands to clear the EME identifiers (i.e. EME salt values and their associated origin pairs). We didn't implement dedicated UI to view EME identifiers, but this was deemed acceptable for our EME MVP because we don't have UI to view other per-site data like IndexedDB.