3 ms·
Which is allowed to use your microphone at any time without asking. In contrast to javascript executed on a website. Edit: To clarify, I'm only talking about t
by lawl 11y ago
Which is allowed to use your microphone at any time without asking. In contrast to javascript executed on a website.
Edit: To clarify, I'm only talking about the sandbox here, I'm aware that there is opt-in stuff and that there is open source code guarding the activation of that specific module, i'd argue that this isn't part of the sandbox though.
- Oletros 11y agoCould the module use your microphone without asking?
- lawl 11y agoYes, that's what I just said and what the bugtracker sais.
- Oletros 11y agoNo the bug tracker doesn't say that
- lawl 11y agoYes it does. > The hotword module has the same privileges as any website (except that it automatically has access to the microphone). My original post was perhaps misleading, I'm only talking about the sandbox here, I'm aware that there is opt-in stuff and that there is open source code guarding the activation of that specific module, i'd argue that this isn't part of the sandbox though.
- whoopdedo 11y agoA slight tangent but is anyone else disappointed with the Chrome permissions system? The granularity of what you can allow is often inappropriate for what you really need to do. Example, the author of uBlock Origin needed to be able to turn off prefetching for obvious reasons. But the permission for it was grouped into the label "Control Security Settings". This confused a lot of people who became suspicious of what the extension was actually doing. It makes me think of how Windows with it's very comprehensive mandatory access control remained vulnerable to simple attacks because the ACLs were too complicated. Thus application developers would request overly broad permissions, defeating the usefulness of the security model. Seems to me that having too many difficult to use security features can be as bad as or worse than too little security.
- timothya 11y agoNo, it can only use your microphone on New Tab pages and Google Search pages, and only after the user explicitly opts-in to it (the module is disabled by default).
- lawl 11y agoIf you read the responses on that bug tracker it does seem it was automatically activated for some. Granted, these might have been a misinterpretation of that chrome://voicesearch page. My phrasing of "anytime" was perhaps misleading, I'm aware that the module is guarded by open source code that activates it under specific conditions. However I was talking about the sandbox, and when the module is running it does have access to the microphone without asking. The code guarding the activation of the module isn't relevant in this context.