3 ms·

This won’t get abused. /s

by rho138 3mo ago

saagarjha 3mo ago
How do you see it being abused?
- unfocso 3mo ago
  "Press here to view the content", there's already plenty in the wild that grant access to notifications with deceptive buttons.
  - cwmoore 3mo ago
    “targeted and functional controls for accessing camera and microphone streams”
  - sheept 3mo ago
    The similar <geolocation> element has clickjacking prevention enforced by the browser[0], and even if the website finds a way around it, it still shows the normal permission prompt.[1] [0]: https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeolocationElement/invalidReason#value https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeoloca... [1]: https://mdn.github.io/dom-examples/geolocation-element/basic-watch-example/ https://mdn.github.io/dom-examples/geolocation-element/basic... (requires Chromium)
    - ameliaquining 3mo ago
      To be sure, evil websites will still be able to put misleading content around the element, and hope that the least savvy users will be fooled or will click the button out of confusion. But they can already do that with the existing JavaScript-triggered permission prompt.
    - akersten 3mo ago
      It's kind of insane to me that effort was put into all these fuzzy make-your-site-randomly-not-work heuristics and at the end of the day it still pops open the permission dialog anyway. It's like the worst of both worlds
- rho138 3mo ago
  The immediate thought is re-prompt spam, for eternity, even with an appropriate signal sent from the user agent. This is the same as cookie banners - keep flushing the cookies after each session if the user agent doesn’t accept and wait until they do. It’s a techbros wet dream on consent. Just keep asking until they say yes.
  - echoangle 3mo ago
    But it’s only showing a button and then the prompt when you click the button. Unless you click the button, it can’t spam you with permissions.
    - timando 3mo ago
      Just make the button transparent over the whole site and make it so you have to accept before it will let you do anything.
      - echoangle 3mo ago
        Opacity is fixed at 1. and obviously you can just break your own site until you get permission, but then people will probably leave before they give your website which has no business accessing the camera permission.

This won’t get abused. /s

by rho138 3mo ago

This won’t get abused. /s

saagarjha 3mo ago

How do you see it being abused?

unfocso 3mo ago
"Press here to view the content", there's already plenty in the wild that grant access to notifications with deceptive buttons.
- cwmoore 3mo ago
  “targeted and functional controls for accessing camera and microphone streams”
- sheept 3mo ago
  The similar <geolocation> element has clickjacking prevention enforced by the browser[0], and even if the website finds a way around it, it still shows the normal permission prompt.[1] [0]: https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeolocationElement/invalidReason#value https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeoloca... [1]: https://mdn.github.io/dom-examples/geolocation-element/basic-watch-example/ https://mdn.github.io/dom-examples/geolocation-element/basic... (requires Chromium)
  - ameliaquining 3mo ago
    To be sure, evil websites will still be able to put misleading content around the element, and hope that the least savvy users will be fooled or will click the button out of confusion. But they can already do that with the existing JavaScript-triggered permission prompt.
  - akersten 3mo ago
    It's kind of insane to me that effort was put into all these fuzzy make-your-site-randomly-not-work heuristics and at the end of the day it still pops open the permission dialog anyway. It's like the worst of both worlds
rho138 3mo ago
The immediate thought is re-prompt spam, for eternity, even with an appropriate signal sent from the user agent. This is the same as cookie banners - keep flushing the cookies after each session if the user agent doesn’t accept and wait until they do. It’s a techbros wet dream on consent. Just keep asking until they say yes.
- echoangle 3mo ago
  But it’s only showing a button and then the prompt when you click the button. Unless you click the button, it can’t spam you with permissions.
  - timando 3mo ago
    Just make the button transparent over the whole site and make it so you have to accept before it will let you do anything.
    - echoangle 3mo ago
      Opacity is fixed at 1. and obviously you can just break your own site until you get permission, but then people will probably leave before they give your website which has no business accessing the camera permission.