Re: [w3c/permissions] Capability Model (#148)

That makes sense, and I understand your position. Unfortunately, that position is at odds with browsers makers' security ux teams. Although we understand that certain apps will have different permissions requirements, we have to worry about literally billions, with a "b", of users being affected by these decisions. 

> the real answer to your question is, I don't understand how a ServiceWorker can use the capability model to prompt for user permission with context when there is no active UI.

It can't. That's by design. You need to show a page first, get permission to use a feature, then the SW can use the feature. Having said that, iOS's model of requesting permission, then letting you know that an app is accessing your location in the background (even if the app is "closed") works*... but still requires an upfront permission grant. 

* I say it works in as far that I trust Apple to do due diligence via user testing of that permission prompt in iOS. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/permissions/issues/148#issuecomment-305962147