Closed
Bug 1205243
Opened 10 years ago
Closed 8 years ago
When locked, disallow apps stacked on top of the lockscreen, except whitelisted
Categories
(Firefox OS Graveyard :: Gaia::System::Lockscreen, defect)
Tracking
(Not tracked)
RESOLVED
WONTFIX
People
(Reporter: freddy, Unassigned)
Details
(Keywords: sec-want)
(I am not sure whether this belongs into Window Management or LockScreen)
This is a defense in depth suggestion: Greg explained how the apps that are currently allowed on a locked device (currently emergency callscreen & camera in safe mode) are stacked on top of the lockscreen, so that one can not bypass the lock screen when it comes to visibility and touch events.
Even if we may want to allow other apps to be placed on top in the future, I propose that we monitor the URL/origin of the apps currently placed on top and verifiy that if their origin contains "gaiamobile.org", we disallow them *except* when they are the safe camera or the emergency callscreen.
This may help preventing lockscreen bypasses through logical bugs.
What do you think?
|
Reporter | |
Comment 1•10 years ago
|
||
Hm, if we allow third-party apps we have to think about window.open(), and nested iframes. This might be trickier than I thought.
|
||
Comment 2•8 years ago
|
||
Firefox OS is not being worked on
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WONTFIX
You need to log in
before you can comment on or make changes to this bug.
Description
•