Re: [w3c/webpayments-payment-apps-api] Use PaymentRequest and PaymentResponse (#99)

This issue as phrased is focusing on syntax, but I think the real disconnect here is dealing with the role of the browser, and syntax is simply being used as a proxy for that issue. For example, @marcoscaceres' explanation of this issue elsewhere includes an assertion that the web app should be responsible for collecting shipping address information, and the means of doing so are tied to the objects being identical on the Payment Request and Payment App sides of things.

This proposal is wrong from a privacy perspective. The notion of how to design systems that preserve privacy is providing information only to those parties who need the information to do their jobs, and withholding it from all others. This proposal violates that principle. It is quite possible that I, as a user, would not like my bank to know who I'm shipping gifts to, and they have no need to possess this information to perform their task. Moreover, if I'm using a Bitcoin app to provide my payment, and the key value proposition of that Bitcoin app is that it has little to no personal information about me, giving it my full name and shipping address defeats its purpose pretty much entirely.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments-payment-apps-api/issues/99#issuecomment-276227625

Received on Monday, 30 January 2017 23:39:56 UTC