[manifest] Privacy Review: how to handle navigation to a fullscreen'd application? (#402) from Mounir Lamouri on 2015-08-25 (public-webapps-github@w3.org from August 2015)

From: Mounir Lamouri <notifications@github.com>
Date: Tue, 25 Aug 2015 02:29:31 -0700
To: w3c/manifest <manifest@noreply.github.com>
Message-ID: <w3c/manifest/issues/402@github.com>

It is actually more of a security issue than a privacy issue. If a user has an application installed and the UA wants them to use it instead of the regular browser experience when clicking on a link, it might be very easy for that application to spoof the user and make them believe they are on another website.

The specification should at least mention that issue and provide some guidance. Maybe show the origin in that case? Always allow the user to find the URL bar?

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/402

Received on Tuesday, 25 August 2015 09:30:05 UTC