Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
What specifically are the security issues that arise by allowing cross-domain image data to be manipulated?
I know that if you have access to both domains you can allow it. I’m wondering why it would be ill-advised to load in Facebook / Instagram images into a canvas to manipulate.
Note that attempting this locally won’t work, must run on localhost or on a server.
I don’t think the security issue is in manipulation — it’s in reading or capturing a screenshot from another page. A variation of the theme is reading raw pixels from an image, that is intended to be displayed, but not for OCR… (e.g. some bank account secrets.)
http://www.contextis.com/resources/blog/webgl2/
From the start WebGL implementations suffered from non-conformance to specifications, which probably led Microsoft to develop alternative technology on IE and simultaneously claim that providing an access to GPU with a web page is a high risk by itself.