W3C home > Mailing lists > Public > public-device-apis-log@w3.org > October 2019

Re: [sensors] Remove text about non-explicit permissions (#396)

From: Anssi Kostiainen via GitHub <sysbot+gh@w3.org>
Date: Fri, 25 Oct 2019 07:19:48 +0000
To: public-device-apis-log@w3.org
Message-ID: <issue_comment.created-546234861-1571987987-sysbot+gh@w3.org>
I assume you read the [note](https://w3c.github.io/sensors/#security-and-privacy) on top of the security and privacy considerations section and that is where the concern ("unexpected statement") originates from, correct? Quote (emphasis mine):

>The Generic Sensor API and its extension specifications are agnostic with respect to any user interface aspects. **This specification defines an integration point to the Permissions API [PERMISSIONS] that implementers can use for explicit or implicit user consenting.** [...]

To elaborate on that, that is to say Permissions API _is_ the "central location". Generic Sensor API spec hooks into Permissions API spec in its [request permission access](https://w3c.github.io/sensors/#request-sensor-access) abstract operation that is called into from the [`Sensor.start()` algorithm](https://w3c.github.io/sensors/#ref-for-dom-sensor-start) step 4.3.

More recently, the group discussed this particular topic at its recent F2F. I'll summarize key parts of that discussion below since I think it is relevant:

Per [resolution](https://www.w3.org/2019/09/19-dap-minutes.html#x05) it was concluded the current state where the spec allows implementers to either (i) use the affordances provided by Permissions API and its extensions (such as [`request()`](https://wicg.github.io/permissions-request/#dom-permissions-request)) or (ii) implementation-specific explicit permission mechanisms in a non-blocking fashion relying on the existing side-effects in [`Sensor.start()`](https://w3c.github.io/sensors/#sensor-start) provides implementers ability to innovate in permissions UX while preserving user privacy attributes. This resolution built upon understanding that it is still being debated whether explicit user consenting affordances are in scope of Permissions API or not. Currently `request()` is shunted into an extension spec with no wide consensus and limited implementer support.

Details in #388 and [Fukuoka F2F minutes](https://www.w3.org/2019/09/19-dap-minutes.html#x04).

In the light of this further context, what are the concrete spec changes the group should consider? I think some clarifications to the above-mentioned note would be in order. @snyderp would you be in a position to propose a better wording for the said note?

-- 
GitHub Notification of comment by anssiko
Please view or discuss this issue at https://github.com/w3c/sensors/issues/396#issuecomment-546234861 using your GitHub account
Received on Friday, 25 October 2019 07:19:50 UTC

This archive was generated by hypermail 2.4.0 : Monday, 4 July 2022 12:47:57 UTC