Security and privacy section must be normative

[alexshalamov]

Security & Privacy section must be made normative to avoid interoperability issues related to cross-origin API access, exposure of powerful features only to secure context, etc.

Currently, browsers implement cross-origin access to the API differently:

Cross-origin access is blocked in:

• Webkit
• Mozilla

Cross-origin access is allowed in:

• Chromium (Issue 598674)
• Edge
• IE (IE11)

Proposal:

• Make Security & Privacy normative
• Block access to cross-origin iframes
• As the Device Motion & Orientation exposes sensitive data, restrict access only to secure contexts https://github.com/w3c/deviceorientation/issues/47
• Reuse applicable mitigation strategies from Generic Sensor API https://w3c.github.io/sensors/#security-and-privacy

[anssiko]

Fixed in https://github.com/w3c/deviceorientation/commit/4f91c34308d35d1a4da32be71a9b17b62248d1e3