search

w3c / payment-handler

Payment Handler API
https://w3c.github.io/payment-handler/
Other
74 stars 42 forks source link

Specify just-in-time installation behavior? #346

Open ianbjacobs opened 5 years ago

ianbjacobs commented 5 years ago

We heard at TPAC 2019 that it would be good for browsers to behave similarly with respect to Chrome's just-in-time installation. UX specifics might differ, but there was a desire for similar semantics.

ianbjacobs commented 4 years ago

Recently it was pointed out that if a payment method manifest at origin A refers to a default payment handler at origin B, the browser should not just-in-time install it due to the service worker security model.

marcoscaceres commented 4 years ago

I also have some concerns around JIT installation, which relates to #363. I'm still a bit uncomfortable with sites randomly installing payment handlers (and their service workers) - but I'm willing to be convinced.

ianbjacobs commented 4 years ago

Hi @marcoscaceres,

We don't want to create privacy and security challenges. I think the consensus is that the user should be aware of software installation, so it won't happen without consent (though the timing of the consent is an active area of discussion).

Ian

marcoscaceres commented 4 years ago

We don't want to create privacy and security challenges.

But that takes all the fun out of it :)

I think the consensus is that the user should be aware of software installation, so it won't happen without consent (though the timing of the consent is an active area of discussion).

Ok cool. Right now, I'm leaning towards exploring what is being discussed in #363. I don't know if that's the right solution or way to go, but worth discussing.

tblachowicz commented 4 years ago

I think the precise definition of the pre-conditions and the algorithm of auto-installation is very important for developers and vendors of the Payment Apps (PHs). Currently, the feature is available in Google Chrome, but it's a proprietary solution to Chrome and details of the pre-conditions or algorithm are not described in any specification. If other browsers e.g. Mozilla Firefox would start featuring auto-installation of PH without common specification that might lead to unnecessary fragmentation. For developers of the Payment Apps it would be much easier to implement according to the specification rather than aligning with specific implementations.

I do recognise the challenges and concerns mentioned above, but I bet there is a way to spec out the common model that would be acceptable by the participating browser vendors.

ianbjacobs commented 4 years ago

I want to note some documentation from Chrome on this: https://docs.google.com/document/d/1bzhh14E1DuJGYrueFhg87decGwvpPQz7D9mLzW8Yif4/edit#