PING call - 3 December - informal chairs summary

PING – informal chairs summary –  3 December 2015

Thank you to François Daoust and Mark Foltz from the Second Screen Working Group for joining our call, again!

Kudos to the Second Screen WG for their careful consideration of privacy and security considerations in the Presentation API.

Thanks to Nick Doty for acting as scribe!

Our next call will be on 21 January 2015 at the usual time.

* Presentation API 

Mark Foltz from the Second Screen Working Group provided an update on the WG’s progress on open issues related to privacy and security considerations concerning the Presentation API [1]:

(a) shared device scenario – how to prevent leakage between one presentation and the next – the WG asked the TAG if there is any existing well-defined context for this – the answer was no – the plan is to define a context that is like private browsing mode (e.g. empty local storage, delete cookies, remove permissions, etc.)

See: https://github.com/w3c/presentation-api/pull/219 

Note: Wendy Seltzer observed that the Presentation API provides a good case for standardizing a “private browsing” mode.

See recent TAG discussion re the Presentation API and “private browsing” mode: https://pad.w3ctag.org/p/02-12-2015-minutes.md 

(b) screen availability – API returns screen available or not. The Second Screen WG will be reaching out to the Web Applications Security WG for their input on whether there are interactions between the Presentation API and the Permissions API.  

(c) mixed content – the Second Screen WG wants to avoid mixed content (HTTP and HTTPS) between the controlling and the permitting context.

(d) nested browsing contexts – the Second Screen WG wants to understand how the Presentation API should interact with nested browsing contexts – in particular, what controls should there be over how iframes request presentations – the WG has decided to allow this by default because while it may annoy the user, it is not seen as a privacy issue – will add an opt-in sandbox context and top-level contexts will have the ability to blacklist or prevent iframes from using presentation

(e) securing the message channel – if the controlling context is on a different device, how can the channel for messages be secured? – this issue is out of scope for the Second Screen WG, but a new Community Group will define a network-level protocol for presentations, including how to secure the communications channel

Nick Doty asked about the potential for phishing attacks in full screen mode. François will open a new issue for “users should have a way to know which origin is being presented at any time”. Nick raised a second issue, namely could the second screen be used by another user? François will also open a new issue regarding multi-user scenarios to review whether implementation guidelines need to be added to the specification (e.g. where a given user may switch from a mode where he or she is the only person in control of a device to a mode where he or she has to share the control with others).

* High Resolution Time Level 2 

PING received a request from Philippe Le Hegaret to look at the privacy considerations of High Resolution Time Level 2 [2]. Potential timing attacks have been identified as a privacy risk, see [3] and [4]. The specification recommends a minimum resolution to protect against cache attacks which could identify the user.

Action: PING chairs to invite the Web Performance Working Group to join a PING call to discuss privacy considerations for the Time Resolution 

* Fingerprinting Guidance for Web Specification Authors

Congratulations to Nick on moving the document to Draft Group Note status. Now that the document is reasonably stable we can invite broader review. 

Action: PING chairs to invite review and input from the W3C community via WG chairs. 

* Privacy questionnaire 

We discussed the importance of moving forward with the PING privacy questionnaire, which would supplement the shorter TAG privacy and security questionnaire. This is a reminder to everyone to contribute to the text Greg Norcie has uploaded to the wiki [5]. 

We also discussed seeking input via the email list on discrete issues. Christine and Greg will set aside some time to see how this might work.

* Next call

21 January 2015 at UTC 17

Christine and Tara

[1] http://www.w3.org/TR/presentation-api/

[2] http://www.w3.org/TR/hr-time-2/

[3] https://github.com/w3c/hr-time/issues/4 
[4] http://arxiv.org/pdf/1502.07373v2.pdf 
[5] https://www.w3.org/wiki/Privacy_and_security_questionnaire

Received on Wednesday, 16 December 2015 15:13:56 UTC