5 ms·

How do you see it being abused?

unfocso 4mo ago
"Press here to view the content", there's already plenty in the wild that grant access to notifications with deceptive buttons.
- cwmoore 4mo ago
  “targeted and functional controls for accessing camera and microphone streams”
- sheept 4mo ago
  The similar <geolocation> element has clickjacking prevention enforced by the browser[0], and even if the website finds a way around it, it still shows the normal permission prompt.[1] [0]: https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeolocationElement/invalidReason#value https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeoloca... [1]: https://mdn.github.io/dom-examples/geolocation-element/basic-watch-example/ https://mdn.github.io/dom-examples/geolocation-element/basic... (requires Chromium)
  - ameliaquining 4mo ago
    To be sure, evil websites will still be able to put misleading content around the element, and hope that the least savvy users will be fooled or will click the button out of confusion. But they can already do that with the existing JavaScript-triggered permission prompt.
  - akersten 4mo ago
    It's kind of insane to me that effort was put into all these fuzzy make-your-site-randomly-not-work heuristics and at the end of the day it still pops open the permission dialog anyway. It's like the worst of both worlds
rho138 4mo ago
The immediate thought is re-prompt spam, for eternity, even with an appropriate signal sent from the user agent. This is the same as cookie banners - keep flushing the cookies after each session if the user agent doesn’t accept and wait until they do. It’s a techbros wet dream on consent. Just keep asking until they say yes.
- echoangle 4mo ago
  But it’s only showing a button and then the prompt when you click the button. Unless you click the button, it can’t spam you with permissions.
  - timando 4mo ago
    Just make the button transparent over the whole site and make it so you have to accept before it will let you do anything.
    - echoangle 4mo ago
      Opacity is fixed at 1. and obviously you can just break your own site until you get permission, but then people will probably leave before they give your website which has no business accessing the camera permission.

"Press here to view the content", there's already plenty in the wild that grant access to notifications with deceptive buttons.

cwmoore 4mo ago
“targeted and functional controls for accessing camera and microphone streams”
sheept 4mo ago
The similar <geolocation> element has clickjacking prevention enforced by the browser[0], and even if the website finds a way around it, it still shows the normal permission prompt.[1] [0]: https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeolocationElement/invalidReason#value https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeoloca... [1]: https://mdn.github.io/dom-examples/geolocation-element/basic-watch-example/ https://mdn.github.io/dom-examples/geolocation-element/basic... (requires Chromium)
- ameliaquining 4mo ago
  To be sure, evil websites will still be able to put misleading content around the element, and hope that the least savvy users will be fooled or will click the button out of confusion. But they can already do that with the existing JavaScript-triggered permission prompt.
- akersten 4mo ago
  It's kind of insane to me that effort was put into all these fuzzy make-your-site-randomly-not-work heuristics and at the end of the day it still pops open the permission dialog anyway. It's like the worst of both worlds

rho138 4mo ago

The immediate thought is re-prompt spam, for eternity, even with an appropriate signal sent from the user agent. This is the same as cookie banners - keep flushing the cookies after each session if the user agent doesn’t accept and wait until they do. It’s a techbros wet dream on consent. Just keep asking until they say yes.

echoangle 4mo ago
But it’s only showing a button and then the prompt when you click the button. Unless you click the button, it can’t spam you with permissions.
- timando 4mo ago
  Just make the button transparent over the whole site and make it so you have to accept before it will let you do anything.
  - echoangle 4mo ago
    Opacity is fixed at 1. and obviously you can just break your own site until you get permission, but then people will probably leave before they give your website which has no business accessing the camera permission.