3 ms·
I know this is probably what most users want but I hate the why Chrome's camera/mic permissions work. Your options are (1) block a domain from camera/mic acces
by greggman3 6y ago
I know this is probably what most users want but I hate the why Chrome's camera/mic permissions work. Your options are
(1) block a domain from camera/mic access
(2) give a domain camera/mic access forever
2 is what people pick. From that point on, that domain, in an iframe, can turn on your camera/mic. That means if messanger.com or meet.google.com or zoom.com wanted to make zoom.com/embed/this/url/as/iframe/to/spy/on/people.html they could, and then sell that service for ads to embed in their ads. They have the permissions needed to turn on the mic/camera whenever they want at that point, no more questions asked.
That bugs me.
Firefox at least has "allow camera access once".
I don't know what a better solution is. One might be mic/camera permission per URL instead of domain. I supposed that's not really any different if you can just append ?dothespything=true
Another might just be that it always asks. It's not like the phone feature of a smartphone has the option to just always answer immediately. Instead you choose whether or not the take the call. Does it need to be any different on a webpage?
PS: I like that webpages have this feature. I like that I can video chat/conference in a sandboxed environment instead of having to install a native app that can spy on me in other ways too. I just wish this permission issue worked differently.
- deleted 6y ago[deleted]
- zitterbewegung 6y agoSafari has only two options. One is to block a domain. The other is remember that you allow it to be used for one day. I think this is probably the best way to compromise on this.
- dillondoyle 6y agoDoesn't chrome already block 3rd party iframe for those permissions? https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-permissions-in-cross-origin-iframes https://sites.google.com/a/chromium.org/dev/Home/chromium-se...
- jazzyjackson 6y agoWell I guess it depends on who is controlling the iframe, it just requires an allow="microphone; camera" attribute.
- lunatuna 6y agoI have no idea about the implementation details, but how about the controls to turn on and off camera/mic are not with the browser or app at all but with the OS. Big red button on the taskbar that you can choose to turn on for a given application or url on demand. Would be great if the OS would log access to the devices too. The browsers are over trusted for things like this and should never have direct access. Google Meet after a crash or the browser was shutdown and restarted with all the old tabs would open up your meeting again hidden behind a bunch of other tabs. No one was ever on them long after the meeting but it was freaky. This isn't the behaviour that I've seen recently thankfully.
- greggman3 6y agoI agree it would be better as an OS level thing and for me personally I'd want the option to have to grant the permission for an app to access the camera every time. Unfortunately I'm not sure how that would be enforced for most apps. For example a browser, my browser runs pretty much until I reboot so if I gave it permission once it would still have permission until I quit. So it seems like the browser needs a permission system on to of the OSes. OS is per app, browser is per domain/page/tab something.
- vlovich123 6y agoI think a simple camera icon in the status bar that appears when an app is using the camera and the user can toggle it on/off. The camera then just starts feeding black to the app. Have it disappear once all apps no longer have the device handle open. This isn’t a difficult feature to design and a pretty simple one to implement at the OS level.
- pjmlp 6y agoBecause it would never work everywhere, it is not for browsers to specify how OS are supposed to work.