Re: Additional security and privacy considerations?

tlr, i appreciate your thought on this matter.  You are right about  
legislators designing UI -- it isn't a good idea.

Fwiw, (and again I believe out of scope for the w3c!) we are  
considering exposing permissions granting decisions via "Larry".  This  
is a mock up for Fennec (Firefox for mobile).  Larry would be a  
different background when permissions have ben modified from default  
by the user.  When clicking on him, you'd see something like:

http://people.mozilla.org/~dougt/larry_for_fennec_mockup.png

Each tile is a different permission that the user granted to the  
site.  So, i think we have been thinking about some of these issues in  
depth, and this mockup is currently being debated.  In any case, does  
this mochup satisfy most of your concerns?  I think the point is, we  
can't do something "special" for geo as there are other user granted  
permissions that we also have to worry about.

Also keep in mind that some UI's disappear.  For example Mobile  
Safari, and Fennec, and Opera Mobile (at least on the HTC Touch Pro),  
disappear when you start interacting with the site.  In such  
situations there is absolutely no UI other than web content.   
Suggesting that we should have a blinking "geo is being used" ui thing  
is a false start i would imagine -- certainly for us.

Again all of this, i believe is _out_ of scope.


Which part of the specification should say consent must not be  
consider to last for longer than two days -- the UA part or the  
location recipient part?

Regard


>>
>> As for the notification, you still use the status bar for a  
>> discreet notification. I don't think that what is being proposed  
>> needs to be highly visible, just accessible.
>
> ... the key phrase being "what is being proposed [doesn't need] to  
> be highly visible, just accessible."
>
> The specification would just have to say that an indicator must be  
> shown in UI as long as a browsing context interacts with a page that  
> has acquired location, and that interaction with this indicator must  
> enable a revocation of location permissions for that site.
>
> The specification should also say that consent must not be  
> considered to last for longer than two days.
>
> Simply not addressing this (I think) would be a serious error.
>
> Regards,
> --
> Thomas Roessler, W3C  <tlr@w3.org>
>