3 ms·

> File system access How about just subfolder access? Limit facebook.com's permissions to only the user/facebook/ folder.

• squiggleblaz 5y ago
  How about just anonymous file descriptors. It asks for a file, the user gives it one or they don't. It can't make any use of any filenames whatsoever.
  • zzo38computer 5y ago
    That can be a better idea. (Unfortunately the HTML file input in any web browser that I have tried does not allow the user to change the file name to a different name than the local file name. This ought to be fixed.) When it asks the user for a file, can also specify the wanted access: read, write, read+seek, or read+write+seek. Requested format can also be specified, but the user should be allowed to ignore the requested format if wanted and instead specify an arbitrary file. For writes, estimated file size can also be specified as a hint, which can also be ignored. Then the user can type in a file name, or for the non-seeking modes, a pipe is also possible. For write non-seeking, the user can specify append or overwrite. For seekable files, a pipe is not valid. For writing to files, the user can also optionally specify the maximum size that the file is allowed to have.
• fragileone 5y ago
  That's basically what file system access is like in Android, unless you give an app Storage permission. Seems sandboxed enough if no other web apps can view it.
  • jen20 5y ago
    What about iframes? This seems like a backdoor for tracking.