RE: ISSUE-28: [Policy] Requirement for NO security prompting [Security Policy Framework - General]

>>I would definitely welcome a design approach that eliminated the need for modal prompts, along the lines of the Mozilla position paper, for example by ensuring that all APIs that potentially cause prompts are
>>asynchronous.
>>
>>Beyond that, I think we should probably avoid prescription wherever possible in respect of user experience for prompts or other permissions-related user configuration.
+1

Marcin Hanclik
ACCESS Systems Germany GmbH
Tel: +49-208-8290-6452  |  Fax: +49-208-8290-6465
Mobile: +49-163-8290-646
E-Mail: marcin.hanclik@access-company.com
From: Paddy Byers [mailto:paddy.byers@gmail.com]
Sent: Wednesday, October 07, 2009 2:45 PM
To: Frederick Hirsch
Cc: Marcin Hanclik; Device APIs and Policy Working Group WG
Subject: Re: ISSUE-28: [Policy] Requirement for NO security prompting [Security Policy Framework - General]

Hi,
I was suggesting the extreme approach for *security* dialogs, since it seems to be a security not-best-practice, and taking an extreme point might help with making a decision by eliciting responses...

Given the arguments in the position papers, I'm wondering why we shouldn't say something in DAP about this.

I think it is absolutely right that this is considered and something is said about it.

However, there will probably continue to be situations where dialogs at runtime (rather than solely at installation time) are unavoidable, depending on the kind of security decision a user is being asked to make.

I would definitely welcome a design approach that eliminated the need for modal prompts, along the lines of the Mozilla position paper, for example by ensuring that all APIs that potentially cause prompts are asynchronous.

Beyond that, I think we should probably avoid prescription wherever possible in respect of user experience for prompts or other permissions-related user configuration.

I was thinking more along the lines of a requirement for now on our spec, rather than a requirement on a User Agent - stating that the spec [SHOULD|MUST] be capable of implementation without modal security prompts during the execution of a web application.

Thanks - Paddy


________________________________
________________________________________

Access Systems Germany GmbH
Essener Strasse 5 | D-46047 Oberhausen
HRB 13548 Amtsgericht Duisburg
Geschaeftsfuehrer: Michel Piquemal, Tomonori Watanabe, Yusuke Kanda

www.access-company.com

CONFIDENTIALITY NOTICE
This e-mail and any attachments hereto may contain information that is privileged or confidential, and is intended for use only by the
individual or entity to which it is addressed. Any disclosure, copying or distribution of the information by anyone else is strictly prohibited.
If you have received this document in error, please notify us promptly by responding to this e-mail. Thank you.