- From: Christine Runnegar <runnegar@isoc.org>
- Date: Wed, 10 Jun 2015 05:52:30 +0000
- To: "norcie@cdt.org" <norcie@cdt.org>
- CC: "public-privacy (W3C mailing list)" <public-privacy@w3.org>
Thank you very much Greg. We informed the Media Capture Task Force that we would be discussing this specification in our June call. Everyone, come prepared with your views on the draft to our next call (25 June) so that we can provide our collective feedback to the TF following the PING call. Greg, we look forward to your feedback on the questionnaire. Christine and Tara > On 4 Jun 2015, at 9:53 pm, Greg Norcie <gnorcie@cdt.org> wrote: > > Hi all, > > Sorry for the late reply. > > Overall, this spec looks really good, we at CDT just had a few small suggestions: > • It would be nice if there was a simple, user friendly way to revoke consent for a stream (especially audio/webcam streams). As it currently stands, once consent is granted there doesn't seem to be simple way to revoke it. > • In section 10.6, it is stated that persistent permissions must be be served over HTTPS and have no mixed content. It would be nice to see the "definition" of mixed content expanded to include the various issues mentioned in Bonneau's recent paper[1]. For example, if a site elects to use pinning, it should be considered to have mixed content if it loads non-pinned content. > Also, as an aside, we used the TAG questionnaire, and while it was very useful, we think it could use some tweaking. And in the spirit of open source, we'll be proposing some tweaks (probably sometime late next week) > > [1] http://www.jbonneau.com/doc/KB15-NDSS-hsts_pinning_survey.pdf >
Received on Wednesday, 10 June 2015 05:53:01 UTC