RE: : comments of Network Information API

So two things seem important here in determining the scope of acceptable risk and reasonable expectations of personal responsibility for choices (risk-aware decision making by the user):

1) experience with the features
2) education of the user

Without an API which provides reasonably useful features and some usable choice mechanisms for the user, I don't think we will ever achieve (1) and will thus not have the need for (2). Would users be aware that their location was sensitive data if there had not been first the APIs making it available and second public dialog (which is an education driver) about the implications?

We will repeat that process with every new data point that we expose via APIs. We can improve it by a commitment to educate the user up-front. While we don't currently have a good forum for that pre-education (so the reactive public media fills in), we can use the on-demand/realtime forum that permission dialogs represent. We have hyperlinking tools at our disposal so that users can follow a "what's this?" link to learn more. I dont think we should just punt on that opportunity by providing feature-restricted APIs that risk nothing and provide little more.

Bryan Sullivan

-----Original Message-----
From: Niklas Widell [] 
Sent: Friday, March 30, 2012 4:02 AM
To: SULLIVAN, BRYAN L; Mounir Lamouri; Public-Device-Apis
Subject: Re: : comments of Network Information API

Yes, but definitely to different degrees. I think "Joe the average user"
might understand that geoloc is something that might be sensitive, while
for e.g. Taking informed decision on exposing network type probably would
confuse even "Jane the advanced and knowledgeable user". In fact that is
probably the biggest issue with prompting that it cannot express degrees
of risk. 

Best regards

On 2012-03-29 08:53, "SULLIVAN, BRYAN L" <> wrote:

>Couldn't that be said for almost any action in which the user is expected
>to give their (presumably) informed consent? How is this different from
>GeoLoc or even the interaction with button/input elements etc which bring
>up file requesters, etc? Won't users that just blow through their
>browsing choices always subject themselves to risky outcomes, regardless
>of the API/markup context that prompted a dialog?
>I believe that most fingerprinting occurs anyway without any user
>interaction or awareness, and unless we are to strip the Web of any
>richness or APIs (want to go back to Lynx, anyone?), fingerprinting will
>always be an issue, but one that is driven also by user choice - that of
>which sites they visit.
>Bryan Sullivan
>-----Original Message-----
>From: Niklas Widell []
>Sent: Wednesday, March 28, 2012 11:43 PM
>To: SULLIVAN, BRYAN L; Mounir Lamouri; Public-Device-Apis
>Subject: Re: : comments of Network Information API
>I think the prompt would only give a false sense of security, a typical
>would user would not understand the fingerprinting issue and would just
>click ok ("who could do something bad with info about my connectivity?").
>Best regards,
>Niklas Widell
>On 2012-03-29 07:38, "SULLIVAN, BRYAN L" <> wrote:
>>I would support a requirement to obtain user permission to access this
>>API, if we were able to get the type attribute back, and get beyond these
>>privacy concerns.
>>Bryan Sullivan

Received on Friday, 30 March 2012 18:42:45 UTC