Skip to content

Commit 3f644f4

Browse files
ianbjacobsianbjacobs
authored
Changes resulting from 28 February PING privacy review (#843)
* Changes resulting from 28 February PING privacy review https://www.w3.org/2019/02/28-privacy-minutes Specifically: * Merged the "Security and Privacy" and "Privacy" considerations sections into a single "Security and Privacy Considerations" * Added a forward pointer from 3.5 to the canMakePayment() protections section (in security and privacy considerations). Removed the Note in the algorithm of 3.5, and merged it with the (rewritten) protections section. * Expanded the canMakePayment protections section based on PING conversation. * One S&P section is normative, the others are informative. Adjusted markup accordingly. * - Editorial tweaks from Marcos - Removed "alert the user" as an idea; deemed impractical * Added back canMakePayment() bullet about informing the user about what data is shared, but rephrased to sound less like it has to be real-time * Update index.html Co-Authored-By: ianbjacobs <ij@w3.org> * Update index.html Co-Authored-By: ianbjacobs <ij@w3.org> * Update index.html (Marcos and Ian edited.) Co-Authored-By: ianbjacobs <ij@w3.org> * Update index.html Co-Authored-By: ianbjacobs <ij@w3.org> * Update index.html * Update index.html * Update index.html Co-Authored-By: ianbjacobs <ij@w3.org> * Update index.html * Update index.html * Update index.html * removed inform user after more conversation with marcos * Update index.html Co-Authored-By: ianbjacobs <ij@w3.org> * tidy
1 parent 2b23c2f commit 3f644f4

File tree

1 file changed

+45
-26
lines changed

1 file changed

+45
-26
lines changed

‎index.html‎

Lines changed: 45 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1375,17 +1375,9 @@ <h2>
13751375
"payment-request/payment-request-canmakepayment-method-protection.https.html">
13761376
Optionally, at the <a>top-level browsing context</a>'s discretion,
13771377
return <a>a promise rejected with</a> a "<a>NotAllowedError</a>" <a>
1378-
DOMException</a>.
1379-
<p class="note" data-link-for="PaymentRequest">
1380-
This allows user agents to apply heuristics to detect and prevent
1381-
abuse of the <a>canMakePayment()</a> method for fingerprinting
1382-
purposes, such as creating <a>PaymentRequest</a> objects with a
1383-
variety of supported <a>payment methods</a> and calling
1384-
<a>canMakePayment()</a> on them one after the other. For example,
1385-
a user agent may restrict the number of successful calls that can
1386-
be made based on the <a>top-level browsing context</a> or the
1387-
time period in which those calls were made.
1388-
</p>
1378+
DOMException</a>. As described in section <a href=
1379+
"#canmakepayment-protections"></a>, the user agent may limit the
1380+
rate at which a page can call <a>canMakePayment()</a>.
13891381
</li>
13901382
<li>Let <var>hasHandlerPromise</var> be <a>a new promise</a>.
13911383
</li>
@@ -5191,7 +5183,7 @@ <h2>
51915183
</ol>
51925184
</section>
51935185
</section>
5194-
<section class="informative">
5186+
<section id="privacy">
51955187
<h2>
51965188
Privacy and Security Considerations
51975189
</h2>
@@ -5271,11 +5263,6 @@ <h2>
52715263
<a>payment method identifier</a>.
52725264
</p>
52735265
</section>
5274-
</section>
5275-
<section id="privacy">
5276-
<h2>
5277-
Privacy Considerations
5278-
</h2>
52795266
<section>
52805267
<h2>
52815268
Exposing user information
@@ -5301,17 +5288,49 @@ <h2>
53015288
consent.
53025289
</p>
53035290
</section>
5304-
<section>
5305-
<h2>
5306-
canMakePayment() protections
5291+
<section class="informative">
5292+
<h2 id="canmakepayment-protections">
5293+
<code>canMakePayment()</code> protections
53075294
</h2>
53085295
<p data-link-for="PaymentRequest">
5309-
The <a>canMakePayment()</a> method enables the payee to call
5310-
<a>show()</a> if the user is ready to take advantage of the API, or
5311-
to fall back to a legacy checkout experience if not. Because this
5312-
method shares some information with the payee, user agents are
5313-
expected to protect the user from abuse of the method, for example,
5314-
by restricting the number or frequency of calls.
5296+
The <a>canMakePayment()</a> method enables the payee to determine —
5297+
before calling <a>show()</a> — whether the user agent knows of any
5298+
<a>payment handlers</a> available to the user that support the
5299+
<a>payment methods</a> provided to the <a>PaymentRequest</a>
5300+
<a data-lt="PaymentRequest.PaymentRequest()">constructor</a>. If no
5301+
<a>payment handlers</a> support the <a>payment methods</a>, this
5302+
enables the payee to fall back to a legacy checkout experience.
5303+
Because this method shares some potentially unique information with
5304+
the payee, user agents are expected to protect the user from abuse of
5305+
the method. For example, user agents can reduce user fingerprinting
5306+
by:
5307+
</p>
5308+
<ul data-link-for="PaymentRequest">
5309+
<li>Allowing the user to configure the user agent to turn off
5310+
<a>canMakePayment()</a>, which would return <a>a promise rejected
5311+
with</a> a "<a>NotAllowedError</a>" <a>DOMException</a>.
5312+
</li>
5313+
<li>Rate-limiting the frequency of calls to <a>canMakePayment()</a>
5314+
with different parameters.
5315+
</li>
5316+
</ul>
5317+
<p>
5318+
For rate-limiting the user agent might look at repeated calls from:
5319+
</p>
5320+
<ul>
5321+
<li>the same effective top-level domain plus one (eTLD+1).
5322+
</li>
5323+
<li>the top-level browsing context. Alternatively, the user agent may
5324+
block access to the API entirely for origins know to be bad actors.
5325+
</li>
5326+
<li>the origin of an <a>iframe</a> or popup window.
5327+
</li>
5328+
</ul>
5329+
<p>
5330+
These rate-limiting techniques intend to increase the cost associated
5331+
with repeated calls, whether it is the cost of managing multiple
5332+
eTLDs or the user experience friction of opening multiple windows
5333+
(tabs or pop-ups).
53155334
</p>
53165335
</section>
53175336
</section>

0 commit comments

Comments
 (0)