Re: [w3c/payment-request] Changes resulting from 28 February PING privacy review (#843)

@pes, @rsolomakhin 
> According to the spec, FF should return false for canMakePayment here.

Yes, you are correct - sorry... I wasn't very clear and didn't give enough context in my response above. The original `canMakePayment()` worked in the same way as the proposed `hasEnrolledInstrument()` - that is, "supports PMI AND has enrolled an instrument".  We used to lie about having the enrolled instrument (because it further adds to finger printing)... 

So, basically we were returning `true` for only known PMIs (of which Firefox knows only about "basic-card"). 

So, @pes, to answer your questions. 

> I'm using Firefox, I haven't ever used any Credit Card info in FF (i.e. it doesn't know if I have a visa). Website calls canMakePayment with credit-card and visa.

True. 

> Same as above, but I've disabled Payment Request API (dom.payments.request.enabled = false)

False. 

Note `dom.payments.request.enabled` would literally turns off the entire API... so rather, you would get a "`canMakePayment()` is no a function" JS exception. 

> I'm using Firefox, but `supportedMethods = "apple-pay".

False. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/pull/843#issuecomment-470419807