RE: Require authenticated origin for geolocation

I personally don’t have a problem with this, as I believe this would be necessary for certain geolocation use cases in the context of payments or dispatch (won’t go into details here – you can refer to my papers in this year’s Web Payments and Web Crypto Worskhops). In other words, it is not just a pervasive monitoring concern.  We can add this to the TPAC agenda to discuss further.

May I ask why you did not suggest a similar 3-step plan of action for gUM?  It seems like an approach that can be adopted broadly within the W3C for sensitive API’s.


From: Doug Turner []
Sent: Saturday, September 27, 2014 1:19 AM
To: Anne van Kesteren
Cc: Ryan Sleevi; Chris Palmer; public-geolocation
Subject: Re: Require authenticated origin for geolocation

On Sep 27, 2014 8:24 AM, "Anne van Kesteren" <<>> wrote:
Given I think we should reconsider
whether to expose geolocation to unauthenticated origins. I don't
think this was duly considered at the time the API was released.

Furthermore, I think that if we agree this is a problem, we could
create a plan for phasing out support where no TLS is involved.

1) Start warning for usage right away.
2) Have developer evangelists spread the date when it will be disabled
(end of 2015?).
3) Disable it.


Received on Saturday, 27 September 2014 15:24:50 UTC