Re: [w3c/payment-request] Changes resulting from 28 February PING privacy review (#843)

zouhir commented on this pull request.



> -          method shares some information with the payee, user agents are
-          expected to protect the user from abuse of the method, for example,
-          by restricting the number or frequency of calls.
+          The <a>canMakePayment()</a> method enables the payee to determine
+          —before calling <a>show()</a>— whether the user is ready to take
+          advantage of the API. This enables the payee to fall back to a legacy
+          checkout experience. Because this method shares some information with
+          the payee, user agents are expected to protect the user from abuse of
+          the method. For example, user agents may reduce user fingerprinting
+          by:
+        </p>
+        <ul data-link-for="PaymentRequest">
+          <li>allowing the user to configure the user agent to turn off
+          <a>canMakePayment()</a>;
+          </li>
+          <li>informing the user when <a>canMakePayment()</a> is called;

after reading the privacy minutes, I actually think this is an OK idea and npdoty questions was good.

Pros:
- Website are likely to be calling this method more responsibly if there is a little UI indication to the users and only do so in the right page and time where users expect this to happen and checkout.

Cons:
- Some users might freak out if they see such a UI notification or indication. there has to be a lot of carefulness and UX research from implementers side how to present this.

Why does it seem impractical?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/pull/843#discussion_r263104206