Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Considerations section should contain additional guidance #58

Open
vabr-g opened this issue Feb 7, 2017 · 0 comments

Comments

Projects
None yet
1 participant
@vabr-g
Copy link
Collaborator

commented Feb 7, 2017

CM API offers protection against a class of XSS attacks to obtain passwords. However, there are still some attacks not prevented by CM API itself. One is described in https://crbug.com/686487 and one more in a particular comment on that bug https://crbug.com/686487#c10. (Not listing those scenarios here until that bug is public.)

We could add a non-normative section in the Security Consideration, listing suggested additional security measures to be used in combination with CM API to provide the best protection against XSS attacks on passwords.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.