942805 - SecReview: Screen sharing UI

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

This feature needs a team size discussion for the architecture:


1) Who is/are the point of contact(s) for this review?
2) Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
3) Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
4) Does this request block another bug? If so, please indicate the bug number
5) This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
6) To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list?  If so, which goal?
7) Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
7a) Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?
7b) Are there any portions of the project that interact with 3rd party services?
7c) Will your application/service collect user data? If so, please describe
8) If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
9) Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

dveditz just forwarded sec-review from bug 928096 to this bug.

There is no design for screen-sharing (UI or otherwise) yet for any other platforms.  Some general issues are shared, though.

ekr, mt and I can help fill in details about general risks for screen sharing.  blassey, can you fill in the parts that discuss bug 928096?  Thanks

Comment 2

[Brad Lassey [:blassey] (use needinfo?)]

(In reply to Curtis Koenig [:curtisk] from comment #0)
> This feature needs a team size discussion for the architecture:
> 
> 
> 1) Who is/are the point of contact(s) for this review?
Brad Lassey and Ian Barlow
> 2) Please provide a short description of the feature / application (e.g.
> problem solved, use cases, etc.):
Allowing users to share a tab as a video stream in a webrtc session
> 3) Please provide links to additional information (e.g. feature page, wiki)
> if available and not yet included in feature description:
> 4) Does this request block another bug? If so, please indicate the bug number
> 5) This review will be scheduled amongst other requested reviews. What is
> the urgency or needed completion date of this review?
Basic UI landed a week ago
> 6) To help prioritize this work request, does this project support a goal
> specifically listed on this quarter's goal list?  If so, which goal?
This feature is on the Fennec product roadmap for Fx31
> 7) Please answer the following few questions: (Note: If you are asked to
> describe anything, 1-2 sentences shall suffice.)
> 7a) Does this feature or code change affect Firefox, Thunderbird or any
> product or service the Mozilla ships to end users?
Yes
> 7b) Are there any portions of the project that interact with 3rd party
> services?
No
> 7c) Will your application/service collect user data? If so, please describe
No
> 8) If you feel something is missing here or you would like to provide other
> kind of feedback, feel free to do so here (no limits on size):
> 9) Desired Date of review (if known from
> https://mail.mozilla.com/home/[e-mail]/Security%20Review.html)
> and whom to invite.

Comment 3

[Eric Rescorla (:ekr)]

As background, here is an overview of the security issues with
this sort of functionality:

http://lists.w3.org/Archives/Public/public-webrtc/2013Mar/0024.html

TL;DR: allowing any Web site to screen share the browser effectively
disables CSRF protection in a variety of settings, which is why
even though this feature is in Chrome, it is behind a preference.
Since users do not even know what CSRF is, it's fairly unclear
how to communicate the security implications of this.

This needs more than

Comment 4

[Eric Rescorla (:ekr)]

As background, here is an overview of the security issues with
this sort of functionality:

http://lists.w3.org/Archives/Public/public-webrtc/2013Mar/0024.html

TL;DR: allowing any Web site to screen share the browser effectively
disables CSRF protection in a variety of settings, which is why
even though this feature is in Chrome, it is behind a preference.
Since users do not even know what CSRF is, it's fairly unclear
how to communicate the security implications of this.

This needs a broader discussion involving at least me, MT, Jesup,
and DougT.

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to Eric Rescorla (:ekr) from comment #4)
> 
> This needs a broader discussion involving at least me, MT, Jesup,
> and DougT.

I believe we had this discussion some time back, but it appears zimbra has eaten the date of this meeting. I know there has been a lively discussion of this particular feature (both at the meeting and on subsequent emails), as such I don't think we need to keep this bug further unless we have a direct task that needs completing.

Comment 6

[Eric Rescorla (:ekr)]

Looks like the feature has landed.