search

privacycg / meetings

Agenda and minutes of meetings of the Privacy Community Group
https://privacycg.github.io
92 stars 21 forks source link

SAA Developer Use Cases: Google Workspace #25

Open johannhof opened 1 year ago

johannhof commented 1 year ago

At Chrome we've recently been in contact with the Google Workspace team (@lghall) about their potential use cases for SAA and they shared some great feedback with us that we encouraged them to discuss publicly in the Privacy CG instead. They filed and commented on a number of issues in storage-access.

Instead of marking all of them as agenda+ separately I'd love to see a consolidated presentation of their developer use case and learnings from their explorations at the (next) regular call, which they are happy to do!

I think Nov 10 works for them but will update this issue pending final confirmation.

cc @annevk @bvandersloot-mozilla @cfredric @martinthomson @erik-anderson @hober @johnwilander

annevk commented 1 year ago

WebKit's Contributor Meeting is on that day which might make things tricky.

johannhof commented 1 year ago

Ok, thanks, that's good to know, we might also have some conflicts on Google side due to the APAC-friendly time, so two weeks later might be better.

johannhof commented 1 year ago

I was made aware that two weeks later (Nov 24) is Thanksgiving in the US so that doesn't really work either, maybe Dec 8?

erik-anderson commented 1 year ago

@johannhof we plan to have this on the agenda for the December 8th call. Please let the chairs know if that doesn't work.

johannhof commented 1 year ago

Slides for Lindsay's and Philipp's presentation today: https://docs.google.com/presentation/d/1YyStdXIdoXT64mkq_C24oKjREmy0582RcUvvpy3XBCk/edit?usp=sharing

Thank you again for sharing your use cases and challenges with us!

annevk commented 1 year ago

Challenge #2: Other Docs frames on the same top-level page are not notified that storage access has now been granted and require user interaction to load properly

BroadcastChannel could be used here, right?

FR #1: There should be a way for a page to indicate in the initial server response that storage access is required, so that a browser-level UI over the frame could be shown prompting for storage access when needed.

This strikes me as somewhat odd. We don't offer this kind of functionality for other permission requests either. It's up to the website to convince the user that it's in their interest to grant access through browser-mediated UI.

johannhof commented 1 year ago

Challenge #2: Other Docs frames on the same top-level page are not notified that storage access has now been granted and require user interaction to load properly

BroadcastChannel could be used here, right?

Probably, yeah, but given that we have existing low-cost primitives on the web platform to enable this (permissionStatus.onchange) it makes sense to support it natively, IMO.

FR #1: There should be a way for a page to indicate in the initial server response that storage access is required, so that a browser-level UI over the frame could be shown prompting for storage access when needed.

This strikes me as somewhat odd. We don't offer this kind of functionality for other permission requests either. It's up to the website to convince the user that it's in their interest to grant access through browser-mediated UI.

Yeah though I agree that this isn't a pattern that we'd usually use on the web platform, I think it's interesting to think about. I know it's not a perfect comparison but I'm interested to explore if there's a "file picker" level intuitiveness we can reach for this. Many German news sites have "two-click" patterns for their social sharing buttons, where you'd first consent to loading the button. I'm not saying this necessarily works here, but I wouldn't cast it out entirely either :)