[w3c/browser-payment-api] Collect Privacy and Security considerations (#331)

Discussed some with @pauljt... would be great to collect more here... please suggest more:

 * [ ]  Protecting the wallet - making sure "data at rest" can't be easily attacked by, for example, other applications. 
 * [ ] Don't store CVV

Payment sheet considerations: 
 * [ ] what numbers to show from stored credit cards (i.e., maybe first 4 and last 4). 
 * [ ] how to deal with too many Display Items in the sheet. 
 * [ ] how to deal with unicode strings and log URLs or origins (specially ones that try to flip the text display). 
 * [ ] Require user interaction bring up payment sheet (e.g., activate a button) 
 * [ ] Maybe delay activation of the "Pay" button in the sheet - so to give more time for the user to understand what is being asked of them. 
 
   

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/331