Re: [w3c/payment-request] Changes resulting from 28 February PING privacy review (#843)

Thanks much for these @ianbjacobs.  

1) Under mitigations / protections, I'm wondering if there isn't the possibility for greater protections / stronger suggestions here.  For example, is there any plausible any scenario where multiple iframes would need to call the canMakePayment endpoint in the same top-level context?

2) What are the avenues for suggesting / proposing that the mitigations become normative?

3) @samuelweiler had suggestions / concerns about the current proposal and negotiating what payment fields are shared (looks like the [options](https://www.w3.org/TR/payment-request/#the-options-argument) argument would be a natural fit).  Will that be part of these changes?

Thanks much!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/pull/843#issuecomment-468859892