Re: Authoring practices on mixed content and unsafe redirects.

Personal information or Personally Identifiable Information is probably
loaded. In the EU that would include an IP address... information with which
identity theft is enabled is fine, but having a credit card # enables bad
things but not necessarily identity theft.

Re: 8.3, I'm still not happy with this text. The reality is that a ton of
sites use TLS to protect the login, and then use a cookie over HTTP
afterwards. It's a calculated tradeoff based on the fact that SSL is still
significantly more expensive than unencrypted HTTP traffic. Take for
instance nwa.com - I log in via SSL, but then I get a cookie that works over
HTTP. When I go back I can see things like my mileage balance, my recently
posted activity, etc. I still have to give my pin again if I want to change
my pin, or if I want to make a booking using a stored card etc, but for the
most part I have the same access as I did with the password. Many webmail
applications are similar - full access minus a few select things (changing
password, for instance).

The consumer and provider of the service are much better equipped to
evaluate that tradeoff than we are. (Well, at the very least the provider is
well equipped to evaluate the tradeoff, and if the consumer desires more
security they have the option of not using that service, or using a service
that does offer SSL for everything, but that cost is going to be borne by
someone...)


On Fri, Mar 28, 2008 at 10:33 AM, Mary Ellen Zurko <
Mary_Ellen_Zurko@notesdev.ibm.com> wrote:

>
> > > "Sensitive transactions also MUST be protected using the same level of
>
> > > protection."
> > > I don't know how to give examples of something that is sensitive, and
> > > something that isn't. Which seems important for understanding
> conformance
> > > to this one.
> >
> > I don't know who contributed this text and have no strong opinion
> > about it.
>
> We (the working group, not you and me) need to have some notion of what it
> means; otherwise it cannot be usefully used in conformance language.
>
> While trolling through more issues to close out or put on an agenda, I
> came (back) to this:
> http://lists.w3.org/Archives/Public/public-wsc-wg/2007Nov/0105.html
>
> "sensitive data, like login information and  credit card information,"
>
> The examples are things sometimes called sensitive personal information.
> Information with which directly enables identity theft in some context. Is
> that the definition we'd like to use here?
>
> >
>
>