Re: New editor's draft shuffles sections.

> I've taken a first stab at my action items ACTION-383, ACTION-384,
> to redo the robustness section.  It's still available here:

> http://www.w3.org/2006/WSC/drafts/rec/rewrite.html#Robustness


typo:
"Knowing the set of secrets the user can choose from can increase the 
attackers ability to spoof them, particularly if a small subset if 
popular. "
is popular

grammer-o:
"Techniques for user agents that expose a voice-based user interface is to 
chose "
Techniques for user agents that expose a voice-based user interface 
including chosing
or 
A technique for user agents that expose a voice-based user interface is to 
chose 

RFC 2119-o?
"For visual user agents, in usage modes in which browser chrome is used to 
signal security context information, that chrome should always be visible 
during interactions with Web content."
For visual user agents, in usage modes in which browser chrome is used to 
signal security context information, that chrome SHOULD always be visible 
during interactions with Web content.

Did you want to RFC 2119 this one too?
"This requirement is scoped to a specific interaction: When multiple Web 
pages might be displayed, security critical chrome need not be present for 
those with which the user is not currently interacting. However, chrome 
used to communicate security context information that relates to the 
currently interacted Web page must always remain on the screen."
This requirement is scoped to a specific interaction: When multiple Web 
pages might be displayed, security critical chrome MAY NOT be present for 
those with which the user is not currently interacting. However, chrome 
used to communicate security context information that relates to the 
currently interacted Web page MUST always remain on the screen.

What are the reasons these are SHOULD's instead of MUSTs? Anyone know/got 
an opinion? 

Web user agents SHOULD restrict window sizing and moving operations 
consistent with 7.1.2 Keep Security Chrome Visible. This prevents attacks 
wherein browser chrome is obscured by moving it off the edges of the 
visible screen.
Web user agents SHOULD NOT allow web content to open new windows with the 
browser's security UI hidden. Allowing this operation facilitates 
picture-in-picture attacks, where artificial chrome (usually indicating a 
positive security state) is supplied by the web content in place of the 
hidden UI.

Missing ref to 6.4.3:
"Web user agents MUST NOT expose programmatic interfaces that allow 
bookmarking without explicit user consent. That consent MUST follow the 
requirements from ."

If we don't have an issue to track this ambiguity, we need one:
"With visual user interfaces that use a windowed interaction paradigm, Web 
user agents [[MAY | SHOULD]] restrict the opening of pop-up windows from 
web content, "
SHOULD is my vote