[azinman2]

But won’t it be on just that FQDN alone? Google analytics and ads are served from a totally different domain. What’s the actual concern here?

[greggman]

Google ads and analytics inject JavaScript which means they can insert iframes for any domain they want. If they injected <iframe src="https:// teachablemachine.withgoogle.com/spyonuserwithcamera" /> they'd be able to use your camera from the ad or analytics without asking for permission again.

Of course I'm not suggesting Google would actually do that but some other company might make seeamazingcamerameme.com to get users to turn on there camera for that domain and then after that make iframes for seeamazingcamerameme.com/spy

[amigoingtodie]

So you are contending we are secure via DNS?

[matt4077]

That's one of these arguments that may attack the parent in isolation, but makes absolutely no sense in the context of the thread they were replying to.

Because if you assume an attacker to have control over DNS, the security model of giving permission on a per-domain basis is broken anyway, and the initial concern with granting google this access is already subsumed in your general paranoia.

[ec109685]

No it isn’t. TLS helps ensure you aren’t talking to a rogue server and HSTS ensures you can be spoofed in the first http request to a new server.