warning on abuse of call me URLs

fixes https://www.w3.org/Bugs/Public/show_bug.cgi?id=25809
On 08/29/2014 01:42 PM, Dominique Hazael-Massieux wrote:
>
> In getusermedia.html:
>
> > @@ -4134,6 +4134,11 @@
> >            <li>Whether or not any of the devices are presently recording ("on
> >            air") indicator</li>
> >          </ul> </p>
> > +
> > +      <div class="note">
> > +        <p>Developers of sites with persistent permissions should be careful that these permissions cannot be abused.</p>
> > +        <p>In particular, they should not make it possible to automatically send audio or video streams from media devices towards an end point that a third party can define: if an URL such as <code>https://example.org/?call=<var>evil</var></code> triggered the automatic capture and transmission of audio and video streams to the <var><code>evil</code></var> user, any page could set up a link or a redirect toward that URL and get streams from the user.</p>
>
> At least in the scenario that Cullen originally described, the evil 
> guy is the one using the call me URLs to capture and receive 
> video/audio from their victim who followed a link or got redirected to 
> http://webrtc.example.org/?callme=evil
>
> (maybe evil should be renamed "ISpyOnYou"?)
>
Aha. That makes sense; a few more words would make it clear.
(after all the discussions on consent-to-receive, the first thing I 
thought of was that the one who got flows he didn't want was the victim).
>
> That being said, there is also the harassing abuse, where one could be 
> harassed via WebRTC if e.g. theirs phones kept ringing because of 
> everyone getting directed to 
> http://webrtc.example.org/?call=HarassedVictim
>

Yup, that's also worth including as an example.
>
> —
> Reply to this email directly or view it on GitHub 
> <https://github.com/w3c/mediacapture-main/pull/9/files#r16893525>.
>