0

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image.

While there are obvious attacks, such as taking screenshot of sensitive information, I don't really believe a screenshot api is more evil than, say, being able to log your key strokes with javascript (which you already can).

So to me, screenshot api is no more or less secure than any other existing api, an attacker using xss attacks can already do what they want.

So are there other vectors I haven't thought of, that makes screenshot api a no-go for browser vendors? Note you can already render some html through canvas/svg, and take screenshots using devtool or extensions.

See:

5
  • I'm confused about what you're asking. Why not this API over some other API. Or are you asking if this API "should" exist?
    – schroeder
    Commented Feb 3, 2015 at 17:56
  • @schroeder The latter. I guess this is not exactly a security question, but the main argument against this API is security concerns, but similar problem already exists in other API, so I am asking if there are security issues besides XSS.
    – bitinn
    Commented Feb 4, 2015 at 3:20
  • I am not sure how to word it more accurately, if someone can help to do that, I am very grateful. Or move it to an appropriate stackexchange sites.
    – bitinn
    Commented Feb 4, 2015 at 3:21
  • Perhaps there is a language issue? "Why not X?" is a question that lacks all context. "Why not cats?" for instance is unanswerable. As for your clarification, a screenshot API would not have a XSS issue.
    – schroeder
    Commented Feb 4, 2015 at 17:46
  • About your question "screenshot api a no-go for browser vendors?" Evernote has a web clipping API, as do many, many other services for web clipping.
    – schroeder
    Commented Feb 4, 2015 at 17:47

1 Answer 1

2

Presumably it would need to not capture content loaded from other domains (like iframes or images), but that seems solvable.

The easiest explanation is that for any feature to exist it has to be prioritized over all of the other features that don't exist. You have to sell it to developers and this seems like it would have privacy implications that would cause users to oppose it.

1
  • Yeah, but that's probably built-in through same-origin and content security policy. Much like canvas.
    – bitinn
    Commented Feb 4, 2015 at 3:23

Not the answer you're looking for? Browse other questions tagged .