Re: Proposal for a Permissions API

On Thu, Sep 4, 2014 at 4:24 PM, Florian Bösch <pyalot@gmail.com> wrote:
> On Thu, Sep 4, 2014 at 10:18 PM, Marcos Caceres <marcos@marcosc.com> wrote:
>
>> This sets up an unrealistic straw-man. Are there any real sites that would
>> need to show all of the above all at the same time?
>
> Let's say you're writing a video editor, you'd like:
>
> To get access to the locations API so that you can geotag the videos
> Get access to the notifications API so that you can inform the user when
> rendering has finished.
> Get user media to capture material
> Put a window in fullscreen (perhaps on a second monitor) or to view footage
> without other decorations
>
> Of course it's a bit contrived, but it's an example of where we're steering
> to. APIs don't stop being introduced as of today, and some years down the
> road, I'm sure more APIs that require permissions will be introduced, which
> increases the likelihood of moving such an example from the realm of
> unlikely to pretty common.
This could make a good case study.

A site that continually prompts the user could negatively affect the
user experience. If the designers of the site appreciate the fact,
then they might ask for fewer permissions. They might even segregate
functionality into different areas of the site with different
permission requirements to lessen the burden on a user. Its kind of
like a forced attrition into principal of least privilege.

If there are no hurdles or obstacles, then sites will ask for
everything whether they need it or not. The web will degenerate into
an Android flashlight app.

Given browsers are going to be executing high value code and handling
high value data (cf., secure origins) and the two choices above, I
think I would rather have the prompts.

Received on Thursday, 4 September 2014 20:36:50 UTC