{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/html/issues/2206","repository_url":"https://api.github.com/repos/whatwg/html","labels_url":"https://api.github.com/repos/whatwg/html/issues/2206/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/html/issues/2206/comments","events_url":"https://api.github.com/repos/whatwg/html/issues/2206/events","html_url":"https://github.com/whatwg/html/issues/2206","id":197032078,"number":2206,"title":"Feature request: Secure Inputs","user":{"login":"ctel","id":9321348,"avatar_url":"https://avatars.githubusercontent.com/u/9321348?v=3","gravatar_id":"","url":"https://api.github.com/users/ctel","html_url":"https://github.com/ctel","followers_url":"https://api.github.com/users/ctel/followers","following_url":"https://api.github.com/users/ctel/following{/other_user}","gists_url":"https://api.github.com/users/ctel/gists{/gist_id}","starred_url":"https://api.github.com/users/ctel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ctel/subscriptions","organizations_url":"https://api.github.com/users/ctel/orgs","repos_url":"https://api.github.com/users/ctel/repos","events_url":"https://api.github.com/users/ctel/events{/privacy}","received_events_url":"https://api.github.com/users/ctel/received_events","type":"User","site_admin":false},"labels":[{"id":255178143,"url":"https://api.github.com/repos/whatwg/html/labels/addition/proposal","name":"addition/proposal","color":"d4c5f9","default":false},{"id":257427609,"url":"https://api.github.com/repos/whatwg/html/labels/needs%20implementor%20interest","name":"needs implementor interest","color":"5319e7","default":false},{"id":402537936,"url":"https://api.github.com/repos/whatwg/html/labels/topic:%20forms","name":"topic: forms","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-12-21T21:02:57Z","updated_at":"2016-12-21T21:31:03Z","closed_at":null,"body":"I want to propose the idea of „Secure Inputs“ for html5. I am aware that this idea is not new at all, but I didn’t find any standard related to html5.\r\n\r\nBasically the idea targets the problem that html elements are accessible from all origins. Often foreign scripts are embedded into a page to form an application. Users use various input fields to provide data, but even with cross origin policies there is the possibility of „_leaking_“ private data to a third party (you can never „_fully trust_“ a foreign script).\r\n\r\nSo my proposed solution: Provide a visual focus notification outside the browsing area whenever a user has the focus on a „special, trusted input element“. Such trusted input fields must contain origin information about their attached handlers.\r\n\r\n**Example**: pageX.tld uses inputs to get some user data. _pageX.tld_ uses a third party script on that page. Whenever an input „generated“ or „captured“ by _pageX.tld_ (means that javascript must create or modify existing input elements somehow) has the focus, a text label outside the browsing area shows the green text „_pageX.tld_“ (similar to TLS cert behaviour). All events of that input element are just deployed to handlers provided while capturing or generating the secure input. Any third party cannot „see“ the value of that secure input field (means that passively waiting for events and actively polling the input provides no data at all).\r\n\r\nTo complete that sandbox behaviour no events like _keydown_, _keypress_, _keyup_ must be propagated through the DOM tree. The label MUST be outside the browsing area; otherwise it’s fakable by malicious third parties.\r\n\r\n_**Why do such secure inputs provide a security benefit?**_ A script from _pageX.tld_ can encrypt data, iff all needed script lives within a closure loaded with a script file of _pageX.tld_ and Crypto functions of the browser are immutable, before sending the encrypted data to a server. Also there can be other foreign scripts embedded on the page helping the web application. Also it supports to build trust to the user: Experienced users are able to distinguish between the browsing area and the surrounding controls. It is easier to explain that benefit to unexperienced users („Hey user! Please pay attention that the label displays the string „_pageX.tld_“ in your browser before inserting your password!“)\r\n\r\nI know this is just a very sparse text. I can write example code explaining the idea furthermore, if you want me to."},"comment":{"url":"https://api.github.com/repos/whatwg/html/issues/comments/268645610","html_url":"https://github.com/whatwg/html/issues/2206#issuecomment-268645610","issue_url":"https://api.github.com/repos/whatwg/html/issues/2206","id":268645610,"user":{"login":"ctel","id":9321348,"avatar_url":"https://avatars.githubusercontent.com/u/9321348?v=3","gravatar_id":"","url":"https://api.github.com/users/ctel","html_url":"https://github.com/ctel","followers_url":"https://api.github.com/users/ctel/followers","following_url":"https://api.github.com/users/ctel/following{/other_user}","gists_url":"https://api.github.com/users/ctel/gists{/gist_id}","starred_url":"https://api.github.com/users/ctel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ctel/subscriptions","organizations_url":"https://api.github.com/users/ctel/orgs","repos_url":"https://api.github.com/users/ctel/repos","events_url":"https://api.github.com/users/ctel/events{/privacy}","received_events_url":"https://api.github.com/users/ctel/received_events","type":"User","site_admin":false},"created_at":"2016-12-21T21:31:03Z","updated_at":"2016-12-21T21:31:03Z","body":"I don't think that such \"_labels_\" would degrade security. It would be orthogonal to existing ideas: The most important part of the idea is that a user actually can \"**_see_**\" which pages have access to the information he/she/it is providing. Iframes are within the browsing area and only people who want to examine the page structure will realise that \"some input X\" is located within an iframe. External labels just provide that information fragment transparently to the user.\r\n\"Secure input elements\" as I call them just need their \"_capturing ability_\", because such a \"_**trust**_\" must be credible on technical aspects as well."}}
{"actor":{"display_login":"ctel"}}