Security and privacy section must be normative

[alexshalamov]

Security & Privacy section must be made normative to avoid interoperability issues related to cross-origin API access, exposure of powerful features only to secure context, etc.

Currently, browsers implement cross-origin access to the API differently:

Cross-origin access is blocked in:

• Webkit
• Mozilla

Cross-origin access is allowed in:

• Chromium (Issue 598674)
• Edge
• IE (IE11)

Proposal:

• Make Security & Privacy normative
• Block access to cross-origin iframes
• As the Device Motion & Orientation exposes sensitive data, restrict access only to secure contexts Should the API be exposed only to secure context? #47
• Reuse applicable mitigation strategies from Generic Sensor API https://w3c.github.io/sensors/#security-and-privacy

[anssiko]

Fixed in 4f91c34