Model Extractability Downloadability

[KooIaIa]

"Rendered data is not exposed to / extractable by the page in this proposal, so no tainting is required."

The model's original source data would still be downloadable by the page right?

Like saving an image from right clicking an tag? You can extract a unrendered model from a model tag - you just can't extract the program used to render it?

[zachernuk]

There are two separate issues in play here - first is the byte contents of a given model file - those would be subject to the same considerations as CORS imposes on other areas - so assets that can be displayed but will resist being fetched would expect to behave the same way.

The other issue related to rendering is the user information that is at risk based on reading the literal "rendered" image of the model. Since that would be based on head-pose (and potentially illumination information) it's not safe to expect that to be readable in a JS context.