TPAC 2019 Agenda. - Githubissues

Suggestions or thoughts about topics we should discuss at TPAC? This would be a lovely place to put them.

Old Things
- For the third year in a row, how do we get Referrer Policy, Secure Contexts, Mixed Content, and Upgrade Insecure Requests to REC?
- Ditto for Clear-Site-Data, Credential Management.
- What are we doing with Content Security Policy and Embedded Enforcement
- ...
Less-old Things
- Fetch Metadata
- Origin Policy
- CORS-RFC1918
- Feature/Document/* Policy (@clelland?)
  - Cookie Controls
- CORP/COEP/COOP + 👻 Spectre 👻
- ...
New Things
- Trusted Types update. Adopt into the WG? (@koto)
- HTTP State Tokens
- Mixed Content 2 (@estark37)
- IsLoggedIn API (@johnwilander)
- CSP Next?
- Double-keyed (or more) caches
- Protecting/sandboxing sites (history.length, caches, window[i])</li> <li><code>Sec-Origin</code> (@deian)</li> <li>...</li> </ul></li> <li>Process Things <ul> <li><a rel="noreferrer nofollow" target="_blank" href="https://www.w3.org/2019/03/webappsec-2019-charter.html">Charter</a> still reasonable? <ul> <li>Putting privacy more clearly in scope and make browser privacy policies part of the security review process</li> </ul></li> <li><a rel="noreferrer nofollow" target="_blank" href="https://www.w3.org/wiki/Evergreen_Standards">Evergreen standards</a>?</li> <li>Relationship with other groups (TAG, PING, HTTPbis, etc.)</li> <li>Security reviews of upcoming features.</li> <li>Various browsers' launch processes</li> </ul></li> </ul> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/annevk"><img src="https://avatars.githubusercontent.com/u/1544111?v=4" />annevk</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>Ideas:</p> <ul> <li>Double-keyed (or more) caches</li> <li>Protecting/sandboxing <code><iframe></code> sites (<code>history.length</code>, caches, <code>window[i]</code>)</li> <li>Putting privacy more clearly in scope and make browser privacy policies part of the security review process</li> </ul> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/mikewest"><img src="https://avatars.githubusercontent.com/u/1497?v=4" />mikewest</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>@annevk: Added those in, thank you!</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/deian"><img src="https://avatars.githubusercontent.com/u/374012?v=4" />deian</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>Is there enough time to briefly chat about a new Sec-Origin header we've been working on?</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/Malvoz"><img src="https://avatars.githubusercontent.com/u/26493779?v=4" />Malvoz</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>Too early to talk about <a href="https://github.com/mikewest/first-party-sets">First-Party Sets</a>?</p> <blockquote> <p>Feature/Document/* Policy</p> </blockquote> <p>I'm not sure how detailed discussions get at TPAC, but I'd like to highlight <a href="https://github.com/w3c/webappsec-feature-policy/issues/85">Cookie control</a>, if I may.</p> <blockquote> <p>Protecting/sandboxing <iframe> sites (history.length, caches, window[i])</p> </blockquote> <p>As a developer <a href="https://webwewant.fyi/wants/16/">I find sandboxing difficult</a>. Either I'll restrict essential features due to lack of documentation from service providers, or take the safe route and restrict a very minimal set of features (or not use <code>sandbox</code> at all). Document-Policy might make things easier, but ultimately I think code distributors need a motivator to provide documentation on which features can be safely restricted without breaking the frame.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/mikewest"><img src="https://avatars.githubusercontent.com/u/1497?v=4" />mikewest</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>@deian:</p> <blockquote> <p>Is there enough time to briefly chat about a new Sec-Origin header we've been working on?</p> </blockquote> <p>Added it to the list. Will you be attending in person, or do we need to find a California-friendly time for you to dial in? Also, is there an explainer document we could link to so folks are up to speed on the proposal when we discuss it?</p> <p>@malvoz:</p> <blockquote> <p>I'm not sure how detailed discussions get at TPAC, but I'd like to highlight Cookie control, if I may.</p> </blockquote> <p>Added.</p> <blockquote> <p>As a developer I find sandboxing difficult.</p> </blockquote> <p>I think it's generally the case that a frame-to-be-sandboxed needs to cooperate with its sandboxer if breakage is to be avoided. Just applying unexpected restrictions is unlikely to be effective, as you note. What do you think this group can do to improve that situation? Where would you like the conversation at TPAC to focus?</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/terriko"><img src="https://avatars.githubusercontent.com/u/1439189?v=4" />terriko</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>I'm interested in CSP Next and also in the security reviews for other W3C projects/features, but I won't be at TPAC. California-friendly times would cover me, and I'll likely be able to shift my schedule later to get more overlap. </p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/hillbrad"><img src="https://avatars.githubusercontent.com/u/2186096?v=4" />hillbrad</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>@johnwilander is there a pre-read for Login API?</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/johnwilander"><img src="https://avatars.githubusercontent.com/u/784671?v=4" />johnwilander</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>@hillbrad, not yet. I hope to publish an explainer of some sort.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/wjmaclean"><img src="https://avatars.githubusercontent.com/u/12088004?v=4" />wjmaclean</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>Can we discuss an Origin Policy for opting in to Origin Isolation? We will have an explainer we can share before the end of this week.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/clelland"><img src="https://avatars.githubusercontent.com/u/45853?v=4" />clelland</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>Re: <a href="https://github.com/w3c/webappsec/issues/555#issuecomment-529440924">https://github.com/w3c/webappsec/issues/555#issuecomment-529440924</a>, there have been a number of different proposals for isolating documents from each other -- this proposal with origin policy, a couple of different feature policy features, 'domain' in sandbox, and probably a couple of other ideas around agent cluster isolation. I don't think it's spefically within the charter, but is a general discussion around that problems space in scope for this group?</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/cyberphone"><img src="https://avatars.githubusercontent.com/u/8044211?v=4" />cyberphone</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>Web2App access is a popular topic outside of the W3C: <a href="https://lists.w3.org/Archives/Public/public-payments-wg/2019Sep/0000.html">https://lists.w3.org/Archives/Public/public-payments-wg/2019Sep/0000.html</a> People do all sorts of tricks to circumvent the limits of the Web. Why not give them something that has a blessing? URL Handlers doesn't really cut it and Web extensions like featured in Chrome (desktop only) are downright horrible since they potentially open open any site for DOM access.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/yoavweiss"><img src="https://avatars.githubusercontent.com/u/786187?v=4" />yoavweiss</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>As part of the FeaturePolicy discussion, would also be great to talk about <a href="https://github.com/w3c/webappsec-feature-policy/issues/55">support for markup based FP declaration</a>.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/arturjanc"><img src="https://avatars.githubusercontent.com/u/665379?v=4" />arturjanc</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>The agenda seems pretty full by now, but it could be interesting to spend a few minutes talking about how we could make the platform safe (or, safer) by default for new applications. </p> <p>That is, now that we have mostly coherent proposals for preventing injections (CSP3/Next + Trusted Types) and locking down cross-origin interactions (COOP, CORP, Fetch Metadata), and we're making progress on Origin Policy, could we bundle them together with a simple origin-wide opt-in? If so, can we even go a step further and enable this by default in some cases? (learning from the successes & mistakes of the HSTS preload list)</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/annevk"><img src="https://avatars.githubusercontent.com/u/1544111?v=4" />annevk</a> commented <strong> 5 years ago</strong> </div> <div class="markdown-body"> <p>I noticed September 17 clashes with Web Components. Not really sure how to deal with that, but maybe leave some stuff for September 19?</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/hober"><img src="https://avatars.githubusercontent.com/u/6235?v=4" />hober</a> commented <strong> 4 years ago</strong> </div> <div class="markdown-body"> <p>I imagine this issue can be closed now. Is there any plan for WebAppSec to meet at TPAC 2020? I don't see the group listed on the <a href="https://www.w3.org/2020/10/TPAC/group-schedule.html">group schedule page</a>.</p> </div> </div> <div class="page-bar-simple"> </div> <div class="footer"> <ul class="body"> <li>© <script> document.write(new Date().getFullYear()) </script> Githubissues.</li> <li>Githubissues is a development platform for aggregating issues.</li> </ul> </div> <script src="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"></script> <script src="/githubissues/assets/js.js"></script> <script src="/githubissues/assets/markdown.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/languages/go.min.js"></script> <script> hljs.highlightAll(); </script> </body> </html>

w3c / webappsec

TPAC 2019 Agenda. #555