WebAPI/Security/Camera

Name of API: Camera API

Brief purpose of API: Let content take photos and capture video and/or audio

Generic use cases: See per-category use cases below

Inherent threats: Steal or spy on user video/audio

Regular web content (unauthenticated)

Use cases:

App allows user to take a picture for a profile
App allows user to take a picture and record an audio clip
App allows user to record a video with audio to send to someone else
App allows user to record an audio clip to send to someone else
App allows the user to start a podcast, open other tabs/apps while the recording continues (to look up and comment on information, etc) and then comes back to the tab/original app to finish the podcast. Note: the user may continue to record while opening or switching to other tabs/apps
App allows foreground photo sharing with realtime preview and special effects. Needs live video stream and the ability to manipulate the stream on the fly (this one might be a bit of a stretch; can work with the magic button or WebGL shader approach but requires some more research)

Authorization model for normal content: user-mediated OS UI

Authorization model installed content: user-mediated OS UI

Potential mitigations:

App can launch a user-mediated viewfinder UI take a picture, record the video, or use the camera/mic feed which user approves prior to it being provided to the content.
Uses video tag (or some such) and is validated to have a non-collapsed extent, not be off-screen, not be (mostly) obscured by other content.
Additionally (contingent upon addressing UX and clickjacking concerns), we could potentially use a "magic button" rendered by OS with the app context.
There is a persistent recording indicator (blinking red light?).
App can continuing recording if it loses focus.
Only top level content can request access.
There is no "always allow" option in this app category.
TBD: Appropriate limitations to device fingerprinting

Use cases:

App allows users to record video from multiple webcams
App allows video monitoring such as a baby monitor or security camera that can run for extended periods of time
App can continuing recording if it loses focus.

Authorization model: Explicit

Potential mitigations: Prompt for camera access, app then retains access to video/audio stream until exit. There is a persistent recording indicator.

Use cases:

Authorization model: Implicit

Potential mitigations: Settings manager could enumerate which apps have implicit access to camera. There is a persistent recording indicator.