747292 - [Security Review] Web Telephony

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task, P1)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Conduct a security review of Web Telephony API.

Background and review notes captured here: https://wiki.mozilla.org/Security/WebAPI/Web_Telephony

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Questions posted to the b2g team

> To start with, can I just ask a few questions:
> 1. Are you the correct contacts for this API (if not then who)?
Ben Turner, Jonas Sicking (CCed both), and I are probably the best contacts.

> 2. Is the API at a point where it is ready to be reviewed formally?
> (I know the app permissions model is pending, but any other major
> blockers?)
This is a good question. I don't think we have any significant changes planned at this point -- Ben, Jonas?

> 3. Do pages have direct access to the audio streams of a phone call?
> (from the code it seems not?)
No they don't.

> 4. What happens if the dialer loses focus? (nothing I assume, but
> will there be a status notification or something to show the user a call
> is active?)
This is an implementation choice of the UI using the API (Gaia in our case) and very much unrelated to the API itself. Personally I would hope that any UI won't kill the dialer when there's a phone call going on and would also show a notification.

> 5. Can another application record audio while a call is underway, and
> capture the call ( I assume yes?)
I don't know of a way to do that right now. If we had a WebAPI way to record audio data from the microphone, then *maybe* it would be possible to record one half of the phone call (depending on how the audio system is set up, it might not even be possible.) But we don't have an API for this (Yet. When we introduce live microphone access, we need to do a whole set of privacy/security analyses anyway.)

> 6. Are the audio streams buffered anywhere on disk
Not that I know of. We currently use the same audio subsystem that Android uses (audioflinger). There are plans to change that, I think, but I don't think it will ever involve on-disk buffering.

> 7. What data about each call is stored, and where (especially any
> user/private data)?
Gecko stores no such data at all. The UI using the API may do so, of course (and Gaia does).

> 8. Are there any links or documentation that I haven't got links to
> on the review page that I should have?
I can't think of anything at the moment, but I'll make sure to let you know when I do.

> Finally, I have started trying to put together some threats on the
> page linked above - if you could have a quick look through, and let me
> know if there are any other threats you have considered, any that occur to
> you that we need to track, or anything else of note.

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

I have captured background information and an initial list of threats and mitigations here: https://wiki.mozilla.org/Security/WebAPI/Web_Telephony

Probably next step is to have a formal meeting.

Comment 4

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Meeting proposed for 4th June 1pm PST

Contribute information here:
https://etherpad.mozilla.org/TelephonyAPISecReview

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:pauljt - should I schedule this or wait for confirmation that this is the date you all want?

Comment 6

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Review Scheduled:
https://mail.mozilla.com/home/[e-mail]/Security%20Review.html?view=month&action=view&invId=130654-130653&pstat=AC&exInvId=130654-181939&useInstance=1&instStartTime=1338840000000&instDuration=3600000

Comment 7

[JP Rosevear [:jpr]]

(In reply to Curtis Koenig [:curtisk] from comment #6)
> Review Scheduled:
> https://mail.mozilla.com/home/[e-mail]/Security%20Review.
> html?view=month&action=view&invId=130654-130653&pstat=AC&exInvId=130654-
> 181939&useInstance=1&instStartTime=1338840000000&instDuration=3600000

Did this review occur?

Comment 8

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Yes, it is linked in the url tab on this bug
https://wiki.mozilla.org/Security/Reviews/WebTelephony

This does however have 3 bugs that were generated as follow-up actions that block this bug.

Comment 9

[Daniel Veditz [:dveditz]]

I think Curtis's most recent mail is saying that our reviews shouldn't be "VERIFIED" until all the dependent bugs are fixed. Moving back to RESOLVED.