Hacker News Reader

Comment by samstave | Hacker News Reader

Question: how could this be exploited to provide unknowing access to a webcams via modifying this .js to run on a subjectively trusted page?

Forgive me if I am being naive but just curious if this could be turned into something that accesses my webcam nefariously?

Anyone on HN willing to test if this is possible?

View on HN

Well, it's opt-in. So unknowing access is (at least without further actions) not possible.

getUserMedia: "Prompts the user for permission to use their Web cam or other video or audio input." [1]

By the way: The example doesn't work for me either.

[1] http://dev.w3.org/2011/webrtc/editor/getusermedia.html

Sure, but I am asking if this can be modded to gain unauth access to the webcam.

Possibly if someone managed to include it on a page you had already given permission.

I don't know if how you'd sent it somewhere with the same origin policy in place.

>Possibly if someone managed to include it on a page you had already given permission.

nope, the "use webcam" permission is per "getUserMedia" call, so 2 getUserMedia calls = 2 allowbar popups.

The 'allow getusermedia' policy is handled by the browser, not javascript.

It's possible that some day there will be a browser bug for bypassing it, but you can't just write javascript code that says "don't ask for permission".

Nowadays the majority of webcams also hard-wire their 'on' light, so the user would at least get an indication that the webcam is suddenly recording.

Reply on news.ycombinator.com