-
Notifications
You must be signed in to change notification settings - Fork 26
Description
Screen-wake-lock if not specified and implemented correctly can be a perfect DOS mode of attack by flattening the battery of the user's machine and rendering it unusable.
-
Whilst only visible documents can acquire the screen-wake-lock, nevertheless the user must be able to control this. Currently the specification says that it is only RECOMMENDED that the user agent shows this to the user, and no reasons are given for this. This should be converted to MUST so that the user definitely has control over it. It you want to stay with RECOMMENDED then you should specify the conditions when MUST does not apply.
-
A state transition diagram would be extremely beneficial to understand when the lock is on or off and how it is activated/deactived etc.
-
The security section as written is rather weak. "Implementations should consider preventing wake lock application if they determine that the remaining battery capacity is low." This is a rather weak statement if we want to prevent DOS attacks. A stronger statement would be "Implementations MUST prevent wake lock application if they determine that the remaining battery capacity is low."