64

I am using Chrome 87 with Jitsi Meet 2.0, but I have noticed this behavior too with other setups. When I first enter a room, Chrome asks for the following permissions:

Use your microphone - Use your camera

Even if I click "Block" to deny these permissions, Jitsi still appears to have access to my entire screen when I click the "Share your screen" button, including other applications and even different virtual desktops. I looked through Chrome's settings, but I couldn't find anything related to screen sharing in the "Privacy and Security" section.

This raises the following questions:

  • How did Jitsi get access to my entire screen?
  • Why didn't Chrome ask me for permission to do so?
  • Can other websites do this too, perhaps even without me knowing?
Improve this question
13
  • 8
    "How did Jitsi get access to my entire screen?" You... clicked the "share your screen" button?
    – TylerH
    Jan 25, 2021 at 15:26
  • 30
    @TylerH and if one chooses to block camera on Chrome, but still clicks the turn on camera on the webapp, do you expect the webapp to have access to your camera? I wouldn't because I instructed my browser not to give access to the camera by the webapp
    – gota
    Jan 25, 2021 at 17:55
  • 19
    @TylerH Consider that case where some Horrible Person (tm) creates a website where the button does not say "Turn on Camera" but instead says "See Cute Animals"... If you deny the site permission to your camera and then click the "See Cute Animals" button, should the website have permission to your camera or not?
    – user3067860
    Jan 25, 2021 at 22:01
  • 8
    @TylerH You didn't say that.. you said if the user clicks the "Turn on Camera" button in the webapp then that should override the Chrome setting. In this case, Chrome has done a poor job of visually differentiating between the browser and the website, so the user clicks on a button expecting the behavior of a website (i.e. no power to change permissions) but instead the button has the power of the browser. (You laugh, but trying to absolutely differentiate between system content and non-system content has been a problem in Windows ever since "ctrl+alt+del to login".)
    – user3067860
    Jan 25, 2021 at 22:16
  • 3
    @TylerH So now finally back to OP's original question: How did the website get access to the screen, since simply clicking a button on a webpage shouldn't be enough, and OP did not see a browser confirmation popup? (The currently only answer to this question is very different than your first unhelpful comment.)
    – JiK
    Jan 25, 2021 at 22:27

1 Answer 1

Reset to default
124

Either way, the user agent responds by presenting a user interface that prompts the user to choose the screen area to share. Both of these implementations of startCapture() return the MediaStream containing the captured display imagery.

Taken from MDN description of screen share API

When you press the screen share button, the browser shows you a list of windows, screens and so forth that you can share. By selecting what to share on that screen, you grant permission. In other words the selection and giving permission is a single step process.

Improve this answer
6
  • 11
    Thanks. I never realized it was a "real" popup instead of one of those "model" popups that asked me which screen to share. That makes sense.
    – Jaap Joris Vens
    Jan 24, 2021 at 11:49
  • 7
    Glad to be able to clear things up :) To answer this, I basically googled 'screen share browser api', which lead me to MDN as the top hit - which explained the flow.
    – vidarlo
    Jan 24, 2021 at 12:42
  • 43
    Depending on the OS, you would also first have to give the browser permission to capture the screen at least once.
    – Jörg W Mittag
    Jan 24, 2021 at 19:26
  • 8
    In this case the popup displays the contents of your windows and screens as part of showing what you would want to share. If it were a 'fake popup', wouldn't it already have all the access it needs to display those?
    – Jason Goemaat
    Jan 26, 2021 at 4:45
  • 3
    @JaapJorisVens The correct term for such a dialogue is "modal dialog", with an a ;)
    – Polygnome
    Jan 26, 2021 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .