Re: Fwd: Browser UI, privacy, and EU law

On 3 October 2012 15:45, Nathan <nathan@webr3.org> wrote:

> can web-id be folded in to RWW, and mail auto forwarded to this list?


Nathan did you mean that the XG (now expired) folded into the public-webid
CG


>
>
> Henry Story wrote:
>
>> Since our community is a bit split on the mailing list still, I thought
>> I's forward this to the
>> XG list.
>> Begin forwarded message:
>>
>>  Resent-From: public-webid@w3.org
>>> From: "Dr Ian Walden" <i.n.walden@qmul.ac.uk>
>>> Subject: RE: Browser UI, privacy, and EU law
>>> Date: 1 October 2012 13:36:05 CEST
>>> To: "'Henry Story'" <henry.story@bblfish.net>, <public-webid@w3.org>,
>>> "'Ben Laurie'" <benl@google.com>
>>>
>>> Dear All,
>>>
>>> The answer is, of course, it depends!
>>>
>>> The relevant legislative measure, Directive 02/58/EC, as amended in 2009,
>>> states the following, at article 5(3):
>>>
>>> "Member States shall ensure that the storing of information, or the
>>> gaining of access to information already stored, in the terminal
>>> equipment of a subscriber or user is only allowed on condition that
>>> the subscriber or user concerned has given his or her consent, having
>>> been provided with clear and comprehensive information, in accordance
>>> with Directive 95/46/EC, inter alia, about the purposes of the
>>> processing. This shall not prevent any technical storage or access for
>>> the sole purpose of carrying out the transmission of a communication
>>> over an electronic communications network, or as strictly necessary in
>>> order for the provider of an information society service explicitly
>>> requested by the subscriber or user to provide the service."
>>>
>>> The references to 'consent' and 'clear and comprehensive information'
>>> suggest that a user should be informed what identity he is giving to a
>>> web
>>> site, since meaningful consent cannot be given unless the individual
>>> knows
>>> what personal data is being disclosed. However, the last sentence of the
>>> article is a get-out provision for data controllers, which means that
>>> consent is not required in all circumstances.
>>>
>>> Kind regards,
>>>
>>> Ian
>>>
>>> Professor Ian Walden
>>> Professor of Information and Communications Law
>>> Head, Institute of Computer and Communications Law
>>>
>>> Centre for Commercial Law Studies
>>> Queen Mary, University of London
>>> 67-69 Lincoln's Inn Fields
>>> London WC2A 3JB
>>>
>>> Tel: +44-(0)20-7882-8086
>>> Mobile: +44-(0)7968-612-581
>>>
>>>
>>> -----Original Message-----
>>> From: Henry Story [mailto:henry.story@bblfish.**net<henry.story@bblfish.net>]
>>> Sent: 27 September 2012 14:29
>>> To: Ian Walden; public-webid@w3.org; Ben Laurie
>>> Subject: Browser UI, privacy, and EU law
>>>
>>> Let me introduce Ian Walden, Professor of Information and Communication
>>> Law
>>> [1], who gave perhaps one of the most entertaining presentations at IETF
>>> 83
>>> at the behest of the Security Area Advisory Group [2] in Paris earlier
>>> this
>>> year on the effect of new EU legislation on software development
>>> relating to
>>> privacy.
>>> It has been a long time since then, and I was not expecting such a talk,
>>> so
>>> I did not take notes. But I am pretty sure this  has some relevance to
>>> the
>>> topic at hand here.
>>>
>>> What I would like to know is if we can start arguing from a legal
>>> perspective now for enhancements to user interfaces in browsers to help
>>> the
>>> user see what identity (s)he is showing to a web site. I am asking this
>>> because in a discussion with Ben Laurie, who works as security
>>> specialist at
>>> Google among many other things [3], Ben seemed to think there was no
>>> requirement in EU law for this. But my take from the talk at IETF in
>>> Paris
>>> was quite the opposite, or at the very least that things were about to
>>> seriously change.
>>>
>>> So let me summarise the UI improvement that I ( and others ) have been
>>> arguing for. Client side certificates - with WebID - allows one to
>>> authenticate ( if one desires to ) to a number of web sites in one click.
>>> This is shown in the short video "WebID & Browsers" [4]. As I point out
>>> at
>>> the end of the video current browsers allow one to log into different
>>> sites
>>> with a client certificate but:
>>>
>>>  1. Fail to make it obvious at all times that one is logged in, or under
>>> what identity
>>>
>>>    So, for example if in Safari one has chosen an identity to log in one
>>> cannot change it, or even ever see that this is the identity/certificate
>>> one
>>> has chosen.
>>>    All the other browsers ask one again on accessing a web site, but
>>> still
>>> don't show the identity used.
>>>  2. Don't make it easy to logout
>>>
>>>     There is a bit of javascript that works on Netscape to log out, but
>>> the
>>> server must present that option. In my view the user should be in
>>> control.
>>> One has to close the whole browser to change identity.
>>>     ( Safari does not allow one to logout at all, ever! )
>>>
>>>  3. Don't make it obvious when one is anonymous
>>>
>>>  Aza Raskin a designer at Mozilla presented a design that in my view
>>> would
>>> solve this and user interaction problems very neatly and put the user in
>>> control of his identity
>>>
>>>      http://www.azarask.in/blog/**post/identity-in-the-browser-**
>>> firefox/<http://www.azarask.in/blog/post/identity-in-the-browser-firefox/>
>>>
>>> Aza did not apply it to https client authentication (TLS) but the design
>>> would clearly work just as well there too. I opened a bug report on
>>> Chrome
>>> for something like this to be implemented
>>>    http://code.google.com/p/**chromium/issues/detail?id=**29784<http://code.google.com/p/chromium/issues/detail?id=29784>
>>>
>>> And similarly to other open source and closed source browsers.
>>>
>>> So the WebID protocol is here to try to create a global distributed
>>> social
>>> network so that we can have more privacy by working in distributed social
>>> networks [5] and not have to all interact on one huge mega-server (or at
>>> least allow people to not have to do that without suffering a large
>>> penalty)
>>> We can get going as is now, but we would like the browsers to put the
>>> user
>>> more in control of his identity.
>>>  So I was wondering if this is now a legal requirement :-)
>>>
>>>
>>>  Henry
>>>
>>>
>>> [1] http://www.law.qmul.ac.uk/**staff/walden.html<http://www.law.qmul.ac.uk/staff/walden.html>
>>> [2] http://www.ietf.org/mail-**archive/web/saag/current/**msg03614.html<http://www.ietf.org/mail-archive/web/saag/current/msg03614.html>
>>> [3] http://en.wikipedia.org/wiki/**Ben_Laurie<http://en.wikipedia.org/wiki/Ben_Laurie>
>>> [4] http://bblfish.net/blog/2011/**05/25/<http://bblfish.net/blog/2011/05/25/>
>>> [5] I have a three minute interview at Oxford internet institute by Prof
>>> William Dutton that covers this
>>>    http://webcast.oii.ox.ac.uk/?**view=Webcast&ID=20100524_323<http://webcast.oii.ox.ac.uk/?view=Webcast&ID=20100524_323>
>>>
>>> Social Web Architect
>>> http://bblfish.net/
>>>
>>>
>>>
>>>
>>>
>> Social Web Architect
>> http://bblfish.net/
>>
>>
>
>