Request for security and privacy review of the Geolocation API Specification

• From: Fuqiao Xue <xfq@w3.org>
• Date: Wed, 24 Jun 2020 11:26:13 +0800
• To: public-privacy@w3.org, public-web-security@w3.org
• Cc: anssi.kostiainen@intel.com, reillyg@google.com
• Message-ID: <5e2e337ccc1e51f9b9429669ef820e0f@w3.org>

Hi,

The Devices and Sensors WG plans to publish a new REC of the Geolocation 
API Specification and requests a security and privacy review. Here's the 
current ED:

    https://w3c.github.io/geolocation-api/

This specification defines an API that provides scripted access to 
geographical location information associated with the hosting device. It 
is now maintained by the Devices and Sensors WG, and contains the 
following substantive changes since the last REC:

    - Now Controlled by feature policy
    - Fixed confusion around callback interfaces not being an 
EventHandler
    - Only expose the API in SecureContexts
    - Renamed the interfaces and dictionaries + removal of 
[NoInterfaceObject] + [SameObject] annotation on geolocation attribute

(Note that the DAS WG is also working on a new API based on the Generic 
Sensor API: https://w3c.github.io/geolocation-sensor/ )

Here's a link to the Security and privacy considerations section: 
https://w3c.github.io/geolocation-api/#security

Please file issues at
https://github.com/w3c/geolocation-api/issues

Thanks,

Fuqiao

Received on Wednesday, 24 June 2020 03:26:19 UTC