<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:rbyers@chromium.org" title="Rick Byers <rbyers@chromium.org>"> <span class="fn">Rick Byers</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - [Privileged Contexts] Enable opt-in to DeviceOrientation and DeviceMotion for HTTPS-based iframes"
href="https://bugs.webkit.org/show_bug.cgi?id=152299">bug 152299</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>rbyers@chromium.org
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [Privileged Contexts] Enable opt-in to DeviceOrientation and DeviceMotion for HTTPS-based iframes"
href="https://bugs.webkit.org/show_bug.cgi?id=152299#c9">Comment # 9</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [Privileged Contexts] Enable opt-in to DeviceOrientation and DeviceMotion for HTTPS-based iframes"
href="https://bugs.webkit.org/show_bug.cgi?id=152299">bug 152299</a>
from <span class="vcard"><a class="email" href="mailto:rbyers@chromium.org" title="Rick Byers <rbyers@chromium.org>"> <span class="fn">Rick Byers</span></a>
</span></b>
<pre>If audio / keystroke capture are really the threat here, then limiting to cross-origin iframes isn't a mitigation. Lots of legitimate sites have all sorts of third party code running in their main frame, and users visit all sorts of illegitimate sites (eg. Not safe for ads, but porn sites go ahead?). I'm skeptical that the browser provides a high enough frequency for those attacks in practice (the audio paper says explicitly that Safari is not affected).
A more rational explanation for this behavior to me may be reducing battery usage. This sort of thing would be a great discussion for <a href="https://github.com/WICG/interventions">https://github.com/WICG/interventions</a> to increase the chance of interoperability around this.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>