search

w3c / tvcontrol-api

TV Control API specification - https://w3c.github.io/tvcontrol-api/
10 stars 11 forks source link

Access to parental control methods #11

Closed chrisn closed 7 years ago

chrisn commented 7 years ago

As currently specified, the setParentalControlPin and setParentalControl methods could easily be brute-forced by a web page to change the PIN or clear the isLocked flag, depending on the complexity of the PIN code set. This may be fine in a device-specific implementation context, but less desirable if the API is accessed from arbitrary web pages. How should these APIs be protected from abuse?

JPEvain commented 7 years ago

Of course the other weak link is the parental control metadata itself, which can probably be easily tampered with

chrisn commented 7 years ago

Closing this as a duplicate of #23.