Privacy issues and API design

[stevem-tw]

The TV Control API has the potential to expose a lot of information to a web app that can be used to track the user's behaviour through a variety of ways. For example:

• Exposing the current source and current channel (and current programme on that channel) can make it easy for an app to track the users viewing habits
• In non-free-to-air systems, exposing the channel list may also expose the list of channels that the user is subscribed to (and thus the details of their subscription package)
• Exposing whether a channel is currently locked by parental control settings can (over a long enough time) allow an app to infer the parental control settings on the device

This ties in with the discussion about application types and which capabilities should be provided to applications. We will need to be careful to ensure that the information we expose doesn't offer unforseen ways of violating the privacy of the user through hostile applications.

[chrisn]

I definitely agree. I previously wrote some notes in this issue, following the W3C's security and privacy guidance questionnaire.