Should permission requests require a user gesture? from Jeffrey Yasskin on 2016-06-02 (public-webappsec@w3.org from June 2016)

From: Jeffrey Yasskin <jyasskin@google.com>
Date: Thu, 2 Jun 2016 10:18:32 -0700
To: "public-webappsec@w3.org" <public-webappsec@w3.org>
Cc: Jan-Ivar Bruaroey <jib@mozilla.com>
Message-ID: <CANh-dXmw_WVkwKAWzXaO8qbz3+dh15=niNwFk=ZTLH6iWTw=zw@mail.gmail.com>

https://github.com/w3c/permissions/issues/77 tracks a suggestion to
require a user gesture in navigator.permission.request() calls. I'd
like to find a recommendation from this group for all new
permission-requesting functions and then follow it for the particular
function in the permissions API.

Jan-Ivar's arguing that requiring a gesture hurts Firefox's permission
model, and that other reasons to require a gesture are better handled
through other browser UI.

What do you folks think?

Thanks,
Jeffrey

Received on Thursday, 2 June 2016 17:19:20 UTC