Re: [w3c/manifest] Add guidance for user agents about how to prevent malicious localization strings (Issue #1150)

Setup:
- User has their system locale set to English.
- The web application has a name & icons defined for both French and English.

Steps are:
1. User installs the web application.
2. User changes their system locale from English to French
3. The name and icon shouldn't be updated without user consent or appropriate heuristics.

To prevent security sensitive members from updating without the user knowing:
1. The user agent can use the system's locale to select the appropriate security sensitive members at install time.
2. The user agent may discard other localizations for security sensitive members because the user has not seen them.
3. The user agent may keep them, but require user consent or or can rely on heuristics to allow updating presented security sensitive members when the user changes their system's locale.


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/1150#issuecomment-2450861245
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/manifest/issues/1150/2450861245@github.com>