[Galene] Re: "This operation is insecure"

[Juliusz Chroboczek <jch@irif.fr>]

> Ok, following your advice I've successfully tested normal video
> conference with an Safari-on-iPad user and the following complete CSP
> header:

I'm a little concerned that if you tweak Galène's defaults, your bug
reports will be somewhat less useful to me than they would be otherwise.

So would you please explain what kind of attacks you're trying to avoid,
so we can converge on a common header that suits everyone?

> 1. disable frames.

Galène doesn't create frames.  Galène's default CSP header forbids inline
Javascript, so even if an attacker somehow manages to get Galène to
include Javascript code in the DOM, it will be ignored.

> 2. limit connect-src to wss: because all traffic must be TLS encrypted.

Secure web pages are not allowed to connect to insecure WebSockets, even
when the CSP allows it.

> 3. tighten resource loading some more just in case some browsers might
> not obey default-src 'self'.

Are you aware of any such browsers?

-- Juliusz