Ultimately it would be best if the web application had access to the camera and other hardware with the user???s permission, but I don???t know if that is really required or desired, Flash currently does a good job of managing permissions around this stuff, but I think more sandboxing is needed for something of the scale I am thinking of.