4 ms·

And what should browsers prompt users with? "Would you like to use WebRTC?" What would that do to improve security for users?

by altano 11y ago

userbinator 11y ago
I'm sure someone could do better than this but here is a first try at a suitably informative prompt: $site_name wants to use WebRTC. WebRTC allows voice calling, video chat, and P2P file sharing, but can also be a privacy risk. We recommend allowing WebRTC only on sites that you expect to use such features on. [Link to learn more] Allow WebRTC for $site_name? Something like Flash's audio/video access prompt would also be a good idea: https://voicethread.com/image/howto/flash_settings_camera_mic.gif https://voicethread.com/image/howto/flash_settings_camera_mi...
- dzhiurgis 11y ago
  Should one add WebGL to the list?
- jnaglick 11y ago
  The preposition at the end of that sentence is unnecessary. Guessing you're from the midwest? :)
  - Dylan16807 11y ago
    It's not; I think you're parsing 'expect to use' differently than intended. "sites that you expect to use such features on" This means "sites on which you expect to use such features" Not "sites where you expect them to use such features" The preposition is key to having you be the one using, not the site. It doesn't have to go on the end, perhaps, and you could rewrite the sentence without that preposition, but simply removing it would leave you with an entirely different meaning.
- altano 11y ago
  Security dialogs like this don't work. No one reads them and in this case it isn't even asking users to make a decision they can understand. It's hard enough to have the right UI when a user is on a site with a broken SSL cert which is really straightforward.
pthatcherg 11y ago
For access to the mic and camera, that's basically what it does already: prompt for permission. So what you're really asking for is "can the web app know my non-NATed IP address if I'm behind a NAT and my non-VPN IP address if I'm behind certain kinds of VPNs"?

And what should browsers prompt users with? "Would you like to use WebRTC?" What would that do to improve security for users?

by altano 11y ago

And what should browsers prompt users with? "Would you like to use WebRTC?" What would that do to improve security for users?

userbinator 11y ago

I'm sure someone could do better than this but here is a first try at a suitably informative prompt: $site_name wants to use WebRTC. WebRTC allows voice calling, video chat, and P2P file sharing, but can also be a privacy risk. We recommend allowing WebRTC only on sites that you expect to use such features on. [Link to learn more] Allow WebRTC for $site_name? Something like Flash's audio/video access prompt would also be a good idea: https://voicethread.com/image/howto/flash_settings_camera_mic.gif https://voicethread.com/image/howto/flash_settings_camera_mi...

dzhiurgis 11y ago
Should one add WebGL to the list?
jnaglick 11y ago
The preposition at the end of that sentence is unnecessary. Guessing you're from the midwest? :)
- Dylan16807 11y ago
  It's not; I think you're parsing 'expect to use' differently than intended. "sites that you expect to use such features on" This means "sites on which you expect to use such features" Not "sites where you expect them to use such features" The preposition is key to having you be the one using, not the site. It doesn't have to go on the end, perhaps, and you could rewrite the sentence without that preposition, but simply removing it would leave you with an entirely different meaning.
altano 11y ago
Security dialogs like this don't work. No one reads them and in this case it isn't even asking users to make a decision they can understand. It's hard enough to have the right UI when a user is on a site with a broken SSL cert which is really straightforward.

pthatcherg 11y ago

For access to the mic and camera, that's basically what it does already: prompt for permission. So what you're really asking for is "can the web app know my non-NATed IP address if I'm behind a NAT and my non-VPN IP address if I'm behind certain kinds of VPNs"?