Re: [w3ctag/design-reviews] Web NFC (#461)

>  I think with a little more consideration in the document regarding these possible abuse cases and the mitigations thereof we would be much more comfortable. 

If the suggestion is to improve the security section, we're all ears. If there are threats that are not covered in the security section, please file issues, or formulate the concerns in a clear way so that we could file issues (the TAG is okay to just say "more work needed on this" - but needs to be specific enough).

So far I could decipher the following:
- I got that we should include guidance about possible and preferred prompting policies (thanks @torgo)
- looking at the other concerns in this thread (thanks @dbaron),  looks like the TAG would feel more comfortable if there was a "peek" functionality to NFC content before sharing with the site; that is, a _prompt_ (if there is any :) ), could show information like what type of tag it is, what type of content is has, and eventually a part of the content if it is text (with an option to show all). That would make the prompt an NFC application itself, but that's before the content reaches the web page
- block lists are an answer to know threats and are needed as such, but they  are by no means a guarantee against other possible misuses; therefore "user education" is a must, which the spec has been trying to do. If you feel something is missing in that regards, please tell.

On the other hand, there are uses that should not raise more concern for NFC than they (don't) raise elsewhere. For instance, if someone wants to share a one time password by NFC, it should not raise more concerns than writing it on a piece of paper, barcodes, or sending it by SMS, email, etc. Users should be able to share content they want. 
Does the TAG want a policy that NFC implementations look into the user data and try to figure out in the best interest of the user, if the user action is good for the user? Wouldn't *that* raise privacy questions? Where is the thin line?


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/461#issuecomment-651600006