Update Security and privacy considerations #47
Conversation
Expand "Request User Consent" considerations, add "Limit API Usage" considerations and suggested mitigations per W3C Security review feedback: w3c/security-request#71
index.html
Outdated
| are encouraged to complement the normatively defined sticky | ||
| activation-based user activation-gating mitigation with the |
There was a problem hiding this comment.
Encouraging implementers to implement normatively-defined things is weird. If they are normative then implementations should be doing them. This section probably needs a larger rewrite given that implementations currently do not inform the user when the API is in use either, or provide a mechanism to disable it.
There was a problem hiding this comment.
Thanks, yes indeed. I think it is clearer to simply remove the sentence starting with "Implementers are encouraged to ...".
And, considering the intent of this specification update is to specify what is currently implemented, the appropriate RFC 2119 term to use in this context is MAY. If implementations agree to add these additional mitigations, we will adjust the term accordingly.
These fixes are at 1304787
Expand "Request User Consent" considerations, add "Limit API Usage" considerations and suggested mitigations per W3C Security review feedback:
w3c/security-request#71
Preview | Diff