search

w3c / webpayments

The document repo for the Web Payments Working Group
https://github.com/w3c/webpayments/wiki
Other
256 stars 62 forks source link

Add privacy concerns README #261

Closed rsolomakhin closed 1 year ago

rsolomakhin commented 2 years ago

This pull request is for a privacy concerns README, mainly touching on Payment Request and Payment Handler APIs.

Preview: https://github.com/rsolomakhin/webpayments/blob/gh-pages/privacy/issues/README.md

rsolomakhin commented 2 years ago

@stephenmcgruer PTAL

stephenmcgruer commented 2 years ago

cc @ianbjacobs ; this is the list I mentioned to you, which I hope to introduce at WPWG next week and then likely discuss at TPAC. Happy to have this sit as a pull request if that's the easiest way to handle it, or happy to see it merged - let us know :)

ianbjacobs commented 2 years ago

@dcrousso

ianbjacobs commented 2 years ago

@rsolomakhin, regarding the proposal to remote PaymentInstruments, see related issue: https://github.com/w3c/payment-handler/issues/371

ianbjacobs commented 1 year ago

@rsolomakhin, should we merge this ?

ianbjacobs commented 1 year ago

I have an alternative proposal. It looks like there are four main issues. Rather than add this to the generic WG repo, how about instead we raise the issues on the relevant specification?

For the background / assumptions, perhaps we could create a new document in the payment-handler repo on privacy assumptions and requirements. We could even model it after what we did for SPC: https://github.com/w3c/secure-payment-confirmation/blob/main/requirements.md

I'm not suggesting that we do a full requirements exercise, only that we create a repository for them and start with what you've identified. I'm happy to create this document, which could then be referenced from the individual issues.

Thoughts?

Ian

stephenmcgruer commented 1 year ago

That plan seems ok from my perspective. Our core goal was to make sure our plans were in the public where people could see them (and raise any concerns), hence this write-up. If you would rather split them out, sgtm, though mostly because you're offering to take on the burden ;)

ianbjacobs commented 1 year ago

Hi @ @rsolomakhin and @stephenmcgruer,

I've created four issues on the payment handler API based on your writeup: https://github.com/w3c/payment-handler/issues/413 https://github.com/w3c/payment-handler/issues/414 https://github.com/w3c/payment-handler/issues/415 https://github.com/w3c/payment-handler/issues/416

I did not create an issue related to removal of Instruments because that has been done: https://github.com/w3c/payment-handler/pull/409

I also updated the verbiage of #414 to reflect that removal.

For the moment I have not created a requirements document, and I'm not sure one is needed at this point. I propose that if we perceive the need we create it.

If you are satisfied with how this content has been migrated to the PH API repo, feel free to close this pull request.

Cheers!

stephenmcgruer commented 1 year ago

Thanks Ian - I am happy for this to be closed in favour of the opened issues