25620 2014-05-09 00:26:20 +0000 Provide informative text regarding the origin-based security model of the API 2014-06-16 23:20:02 +0000 1 1 1 Unclassified Web Cryptography Web Cryptography API Document unspecified PC All RESOLVED FIXED P2 normal --- 1 sleevi sleevi d public-webcrypto rsalz oldest_to_newest 105517 0 sleevi 2014-05-09 00:26:20 +0000 Raised by the W3C TAG review ( https://github.com/w3ctag/spec-reviews/issues/3#issuecomment-41521737 ), and also by Rich Salz via Twitter, the spec is insufficiently clear that it relies upon the same-origin security model. In particular, the spec lacks any notion of Key storage/persistence, so implicitly all Keys are restricted to the current browsing context. However, because Keys are structured clonable, they are permitted to be used with storage APIs (like Indexed DB), which are origin-restricted, or allowed to be used with explicit inter-origin messaging APIs, such as postMessage. Explaining this concept is important for explaining the security model of Keys, where they come from, and how they are used. 107907 1 sleevi 2014-06-16 23:20:02 +0000 https://dvcs.w3.org/hg/webcrypto-api/rev/7a79e816e31b