08:29:58 RRSAgent has joined #devices 08:29:58 logging to http://www.w3.org/2008/12/10-devices-irc 08:30:04 RRSAgent, make log public 08:30:13 Meeting: Workshop on Security of access to device APIs from the Web 08:30:24 Chair: Nick Allot, Thomas Roessler 08:32:36 adrian_hb has joined #devices 08:34:07 ArtB has joined #devices 08:35:16 ArtB has changed the topic to: Workshop on Security of Access to device APIs from the Web http://www.w3.org/2008/security-ws/agenda.html 08:38:01 [tlr introduces the workshop, reviews the agenda] 08:44:22 matt has joined #devices 08:46:50 scribe: Matt 08:51:55 Topic: Security for Access to Device APIs from the Web, Art Barstow, Nokia 08:52:06 fjh has joined #devices 08:54:13 DKA has joined #devices 08:56:15 Anil has joined #devices 08:57:40 smb has joined #devices 09:00:49 Anders: What about OSS? The mobile industry with a few exceptions is going open source. 09:01:17 ArtB: A few ways: the w3c can't get specs to the Recommendatino phase until there are two interoperable implementations, so OSS makes a lot of sense. 09:01:28 ArtB: WRT Widgets, there are already some OSS things there. 09:01:52 ArtB: OTOH there are some movements to not do specs until there's an OSS implementation in existance. 09:02:15 Topic: Security Challenges for Internet Technologies on Mobile Devices, Anil Dhawan, Microsoft 09:03:42 hendry has joined #devices 09:08:03 MikeSmith has joined #devices 09:10:02 Ben_Lowrie: Verifiable disclosure, what is that? 09:10:24 Anil: That is making sure the manifest is secure, that no one has tampered with the privileged manifest document. 09:10:42 Frederick: Declarative vs Run-Time, why are those alternatives? Why not have both? 09:10:45 marcos has joined #devices 09:11:19 Anil: Those are things to consider from the user perspective. A bunch of checkboxes before running an app,it's not obvious what is going to be done with that. 09:11:27 PHB has joined #devices 09:11:46 ArtB: The six items on the last slide (Opps for Standards), are any of those good for being worked on within the w3c? 09:12:00 Anil: Those are some things we think belong in standards bodies, and if we can do that fantastic. 09:12:06 s/Lowrie/Laurie/ 09:12:15 ??: What if the widget downloaded does not meet the risk requiremenets, but the user still wants to run it? 09:12:21 s/??/Fabio/ 09:12:38 Anil: That falls back to policy, Operators know what they want there obviously, but to us it's a policy decision. 09:12:40 We really need to start with a risk analysis and then look at where standards can help 09:13:13 Topic: Security Assurance for Web Device APIs, Steven M. Bellovin, Columbia University 09:14:19 I can't work out what the security requirements are before implementation, so how could a solution be complete? 09:16:07 [Actually the users will do the wrong thing when they do understand the circumstances!] 09:18:41 users want to get something done and view security as a barrier 09:22:16 Accounting needs greater consideration 09:24:05 Fabio: Are you sure it's a good idea to attach the category to the device and not the application? 09:24:33 smb: This may be semantics When I talk about a device, like a smartphone browsing the Web, it might be microphone input... so I'm not talking about the device as the phone, but the device on the phone, such as the microphone. 09:24:59 PHB: It might be useful to think about the difference between mobile and stationary devices. 09:25:59 PHB: Old computers had accounting. 09:26:13 smb: Where is the high assurance way to turn off data roaming for instance, without malware being able to turn it back on 09:26:20 PHB: 09:27:39 smb: There are a lot of concerns there. Vendors of say, smartphones that have controlled what apps can be downloaded and installed, they also may use that security to make sure that applications don't compete with their own applications. 09:28:03 q+ 09:28:10 Zakim has joined #devices 09:28:13 q+ fjh 09:28:44 Nick: What SDOs? What about OSS? Patent land mines? Installable applications over the Web Trust and code identity? 09:29:12 Nick: Risks and mitigation, how do we value these things? How are we aware of what an application claims it wants to do vs what it does? 09:29:24 Nick: Device discovery and capabilities discovery... 09:29:44 Nick: The user is a major element in this, what have they been trained to do, what role do they play? 09:30:19 q- 09:30:21 Nick: "Fragility", you can design the best theoretical system that you'd like, but we know the problems aren't usually the theoretical systems, but the bad implementations. They should fail gently. 09:30:29 Topic: Open Discussion 09:30:37 Can view SDO cooperation as well as competition 09:30:41 q= 09:30:45 q+ 09:30:59 dougt has joined #devices 09:31:13 pauld has joined #devices 09:31:14 Nick: Cooperation between SDOs can be difficult, differences in IPR, etc, slows things down. 09:31:20 fjh: Depends on the organizations being considered... 09:31:26 ack PHB 09:31:45 PHB: there are too many people involved to get them all together in one place that you can trust. 09:31:57 some number of SDOs form an ecosystem 09:32:02 PHB: Once SDOs get beyond 1000 or so it's hard to know everyone. 09:32:29 PHB: The mobile Web is different in some ways, but not all that different. We don't want to create a whole new platform for mobile devices. 09:32:57 PHB: The Web Consortium needs to serve the Web platform, but once you get to applications there isn't enough bandwidth. 09:33:28 ??: What is an application then? 09:33:36 PHB: 09:33:42 Nick: Role of Open Source in this area? 09:34:02 maxf has joined #devices 09:34:24 s/??/Nick/ 09:34:26 Nick: Are the Open Source initiatives going to have a role to play with early prototypes, etc? 09:34:39 Kai: I'd argue that the best software should win, whether it's Open Source or not. 09:34:49 Kai: There should be competition. 09:35:22 pauld: We see great value in open source for requirements gathering. In proprietary world, there's lots of stuff out there that claims to be backed by research, etc, but there's no better research than getting it out there. 09:35:54 ??: I think this relates to Art's question: if we don't get the major players involved, why bother? 09:36:11 ??: Many of the OS projects are driven by commercial entities. 09:36:30 dougt: How is this different than a commercial company then? 09:37:02 s/??/PaddyByers/ 09:37:03 s/??/PaddyByers/ 09:37:05 ??: No different, except open source is a vehicle to get things proliferated as a de facto standard in a way that commercial projects aren't? 09:37:08 s/aren't?/aren't./ 09:37:09 s/??/PaddyByers/ 09:37:19 q+ 09:37:19 dougt: Doesn't matter then if you're closed or open source, it's how many users you have. Commercial vs open source is somewhat orthogonal to security in general. 09:37:39 PaddyByers: An OS implementation that you can use is not enough. 09:37:46 q? 09:38:06 rrsagent, where am i? 09:38:06 See http://www.w3.org/2008/12/10-devices-irc#T09-38-06 09:38:06 I suggest not using Zakim for queue management 09:38:10 smb has joined #devices 09:38:18 zakim, bye 09:38:18 Zakim has left #devices 09:38:19 instead, wave your hands -- the session chair isn't looking at IRC 09:38:37 Nick: Getting the right people involved... because we're talking about accessing device APIs the number of people involved has increased many fold. 09:39:17 Nick: Ooperating System implementors, application developers, and middleware players... this makes collaboration more complicated. 09:39:18 PHB: Are we asking about Open Source because we are afraid there won't be any? 09:39:37 PHB: If the devices are open, regardless of what we decide, then OS will grow. 09:39:47 dougt: What does an open device mean? 09:40:00 AndreaT has joined #devices 09:40:20 PHB: I can write an app and put it on my device, without worrying about it competing with the vendor. 09:40:24 Greetings. Andrea Trasatti, dotMobi. I hope it's OK, if I quitely read.... 09:41:23 David: In the case where there are contractual obligations you have to follow them... 09:41:35 Nick: For instance who has your credit card, or debit card numbers, etc...?? 09:42:28 dougt: For instance my cable provider has my credit card number and charges me for bandwidth, but has no control over the applications I use. 09:42:29 dougt: The mobile phone case is slightly different due to subsidies, etc, but... 09:43:19 PHB: Discussing whether open source is going to play a role in developing device APIs etc, doesn't strike me as useful, regardless of the opinion of the people at this table, it's going to happen. So really, this discussion is just a proxy for the openness discussion. 09:43:46 ??: Open source and openness those two subjects are fundamentally, simply, don't have anything to do with each other.. 09:43:53 s/??/Arve/ 09:44:20 Arve: You can deliver the greatest open source device in the world and you could still have the device locked down for signed applications. 09:45:08 Nick: Irrespective of whether OSS has a role, there could be a role in testing, etc. ?? 09:45:16 pauld: Are you suggesting a reference implementation? 09:45:25 Nick: Well, I've got a particular feeling about it... 09:45:37 Nick: Who are the core players here? 09:45:45 LucasAdamski has joined #devices 09:45:54 dougt: Geolocation is going to be one of the first implementations of device APIs within browsers. 09:46:08 dougt: It'll be deployed in fennec and fx desktop client. 09:46:22 dougt: In fact, in fx 3.1 the draft spec implementation is there, but with no location provider provided. 09:46:31 dougt: WebKit/Apple will follow. 09:46:51 dougt: If you want to model it, and it's development, then you'll want to follow it. 09:47:10 Nick: You're talking about the companies in that WG then? 09:47:32 dougt: The UAs in that group, sure, not saying they should be the only ones involved, but that's a good thread to watch. 09:48:05 Anil: We've got a great representation across the board, but who is going to build the scenarios we're actually talking about? Where is the developer that we're talking about? Who is representing the next killer app? 09:48:15 Anil: What can we do to bring that voice here? 09:48:27 Nick: I think those people are identifiable. 09:48:43 Nick: They are usually companies who run into the brick wall of being tied to the platform... 09:49:18 Nick: They're identifiable, and should be engaged. 09:49:33 Anil: Build it and they will come vs build it and make sure they come. 09:49:38 Nick: They've hit these problems before really... 09:50:07 tlr: The environment we're talking about, JavaScript and DOM. There's a hell of a lot of rope for developers to hang themselves. There are lots of moving parts for these things to be secure.. 09:51:32 tlr: We've got things that resemble device APIs, things like the widget platforms. e.g. Google Mail widget, it had to write the subject header of a message.. so it over wrote document.innerhtml... so you could embed HTML and script in there. You could easily write a mail that could take over your computer. It's basically getting access to system(3) 09:52:30 tlr: Anything that displays HTML, most apps don't use their own parser, but the HTML parser given to them by the system. Same problem, slight variant. If there is a cross site scripting problem in a page seen by a widget then it turns into a vulnerability on the computer... 09:52:46 tlr: We need to keep these things in mind, in addition to just API design. 09:53:37 tlr: People have been talking about least privilege capabilities... a widget declares only the capabilities that you need. In the cases that I've just listed, the widget declares that it's going to want system access... 09:54:08 tlr: When talking about least privilege, think about how it will be used, what causes users to escalate privileges? 09:54:14 smb has joined #devices 09:54:18 pauld, sounds good. 09:54:32 tlr: One of the reasons people use widget.system they just want to display a growl notification. 09:54:50 tlr: There's a lot of rope being given to people. Conservative design of the APIs will be a very important piece. 09:55:01 suggests tag for workshop of #w3cdevices 09:55:04 tlr: A design that lets app developers do what they need to do without shooting themselves. 09:55:26 tlr: I hope the work that goes on in this room will help close the box on these issues. 09:56:10 Lucas: People coding the rich internet applications isn't their problem, but that we are using this stuff to work in a way that it wasn't designed to in the first place. 09:56:39 Lucas: The solution is to have the developer declare their intent. But those will fail at the same way, if the pace of the underlying implementation is not keeping up. 09:57:01 Lucas: These models have to be flexible enough to keep pace. 09:57:13 Lucas: New design patterns have to be supported explicitly. 09:57:25 Lucas: Right now we give the developer a grenade and pull the pin. 09:57:37 Lucas: You have to write your own parser or do complex escaping, etc. 09:57:58 Lucas: Right now the bar is so low that no one bothers going 'up here', when 'down here' there's enough. 09:58:32 Arve: We shot ourself in the foot in 1995 or so, with the introduction of , which allowed off-site content. We can't really fix that. 09:58:47 Arve: We have to work with the broken security model of the Web. 09:59:03 Arve: We've been giving them enough to shoot themselves in the foot, but we have to make sure they don't shoot their legs off in the process. 09:59:17 Arve: So, anything we do has to work with least privileges. 09:59:34 Lucas: We can change the sandboxes... 10:00:05 Lucas: Every time you think about giving folks access to things, either new APIs or new sandboxes, then you have a chance to get them to subsribe to a new security model. 10:00:21 Lucas: We're looking at this in content security policy... 10:01:26 fjh: I think tlr made a good point: if you want to use say, growl or someone elses work, people will want to do that, but there's no API for it. You can't predict what it would be. You need a way to do this without using a system call. 10:01:54 Lucas: Think of it in services, like here's a notificatin service, tell them what services are available, etc. 10:02:12 Lucas: The more generic those APIs... ?? 10:02:28 Paddy: On JS sandboxing and eval, my project, supports those compatibly. 10:03:11 Nick: This WS is about device APIs, W3C and secure access. The question we need to keep in mind as we have these discussions: within this domain, what is it we need to standardize? 10:03:25 Nick: There are plenty of companies here that already do these things, all in different ways. 10:03:42 Nick: There are lots of big issues here, we can't do it all in one go, so what needs to be prioritized for standardization in this area? 10:04:08 Nick: So at the end of these two days, we should have figured some of this out. 10:04:24 Nick: So, what are the priorities so far? 10:05:22 ??: A lot of the things going on already, specifically widget systems. Widget packages have access to device APIs, with some declaration of their security policy. Some people are talking about Web sites accessing these APIs. What are the priorities of each of these two things? 10:05:33 Nick: Widget vs Web contexts... 10:05:59 Steve: We've had to address this quite a bit, we started with the idea that only device access would come from widgets, but we had problems with that from our content providers. 10:06:49 tlr: If you take the widget examples I just took, most of them fail at the point where they are ??special . 10:07:34 smb has joined #devices 10:08:14 tlr: The two contexts share the environment... it's probably important to look at both at the same time, otherwise you're probably looking at more vulnerabilities. I think it's important that we don't end up diverging, but consider both together. 10:09:07 tlr: If we look 5 years ahead, most interesting things will be on the Web. Making the device APIs different between the two will make it worse. 10:09:32 ??: We should look at Widgets and Web Applications at the same time? Does that mean you should find the same security solutions? 10:09:59 tlr: I think we should aim to find the same solutions. There's a large cost to separating these things. The cost might be worth it. 10:10:29 tlr: The cost is high and we shouldn't make the tradeoff just in passing. It needs to be a concious discussion where the two space should converge and it might make sense to separate them, if anywhere at all. 10:10:54 Lucas: They're already convering, right? Why would we want them to be different? You may have to reconcile the differences between the two models. How do you do that? 10:11:17 ??: The distinction, if you have WebKit on the iPhone, the user doesn't know if it's a widget or a web page. 10:11:48 ??: You want the user at least aware, if not in control of what happens. The issues you're presenting the user with in those cases aren'[t that different. Maybe one is a widget install, the other is maybe a bookmark.. 10:12:07 ??: In the widget space, we... 10:12:25 ??: Keeping focus on the Web site use cases is important. We're going to have the same issues. 10:12:38 ??: You may have to do these things different in the two cases, but there's no reason for the APIs to be different. 10:12:44 s/??/Paddy Byers 10:13:15 ?? in the previous few points is Paddy Byers 10:13:31 (putting it on the record for the moment since the s// will only apply to the last point) 10:13:32 maxf: I think all of the points made thus far have been in favor of treating them the same, perhaps we all agree? 10:14:17 Nick: We might have to implement them in a different manner, but the intent, I think is a good one. If we could get consensus on that, it'd be good. 10:14:41 Arve; I do not think the same solutions will apply. 10:14:48 s/Arve;/Arve:/ 10:15:15 Lucas: Ideally, theoretically, the user always makes a trust decision. 10:16:24 Lucas: I don't think there will be any difference. i think the user will be making a decision based on a trust model based on origin. 10:16:33 arve has joined #devices 10:16:39 Lucas: In the WebApps case it's ssl, in widgets it's ?? 10:16:54 PHB: Whenever trust is said, the next thing mentioned is identity. With trust we're really interested in accountability. 10:17:05 PHB: I don't care who I get my code from, I want the to be accountable. 10:17:16 PHB: That's the only reason you have identity there. 10:17:37 Nick: resume at 10:45 10:29:09 StewartB has joined #devices 10:38:57 Dowan has joined #devices 10:41:28 arve has joined #devices 10:47:52 rrsagent, draft minutes 10:47:52 I have made the request to generate http://www.w3.org/2008/12/10-devices-minutes.html matt 10:48:24 maxfroumentin has joined #devices 10:49:26 heh 10:50:05 im on a g1 device. cant scribe :) 10:50:21 i/particular feeling about it.../Topic: Open Discussion/ 10:50:28 rrsagent, draft minutes 10:50:28 I have made the request to generate http://www.w3.org/2008/12/10-devices-minutes.html matt 10:50:39 ScribeNick: maxfroumentin 10:51:01 Topic: A New Approach to Online Location Privacy, John Morris, CDT 10:51:19 pauld has joined #devices 10:52:02 matt has left #devices 10:52:02 scribe: maxf 10:52:24 John: proposing a new model for location privacy 10:52:31 matt has joined #devices 10:52:57 user needs to be able to set privacy rules, not the web site 10:53:15 work going on in IETF [geopriv working group] 10:55:15 Anil has joined #devices 10:56:17 mahemoff has joined #devices 10:56:52 amachin has joined #devices 10:59:39 amachin has joined #devices 11:03:30 ??: there's some work at Liberty Alliance related to that 11:03:39 s/??/Friedrich/ 11:03:56 q+ 11:04:21 s/Friedrich/Frederick/ 11:04:23 [ the group has listed the Liberty Alliance amongst the groups it will liaise with, we'll probably be pursing that once the first draft is published ] 11:04:30 DKA has joined #devices 11:04:39 John: generally familiar with it. Location is a particular area that has a particular sensitivity with people 11:04:50 madofo has joined #devices 11:04:58 I think that the idea of transmitting rules is tremedous 11:05:40 ??: how do you bind the restriction to the information 11:05:55 John: you send the information as xml along with the data, but there's no techincal binding 11:06:07 s/??/Randy/ 11:06:10 smb has joined #devices 11:06:17 ??: but you have legal issues, tying the data with its source 11:06:25 wonders if FireEagle are involved with / aware of this work 11:06:26 Liberty Alliance has work in this area, Identity Governance Framework 11:06:53 Application can specify data used and conditions, CARML and service provider can specify how data should be used, profile of XACML 11:06:58 John: true, but the legal enforcement machanism is going to be on the 10000th case when a particular provides has a pattern of violating the rules. Data commisionners will take action 11:07:17 This offers potentialy usefl generic approach that leverages some existing standards like XACML 11:07:23 so these rules could be split off, but whoever does it could face legal action 11:07:39 Related open source work exists, including some work in Higgins 11:08:16 PHB: on Exif. Cameras are getting GPSs. We could have whatever privacy we like. If the raw data contains wrong geo information, we have a problem 11:08:58 John: the photo can be retransmitted, but it's not necessarily tied to who took it 11:08:58 Art: ?? 11:09:09 URI for identity governance framework - http://www.projectliberty.org/liberty/strategic_initiatives/identity_governance 11:09:50 s/??/IPR declarations?/ 11:11:06 John, if any IPR declarations regarding Geopriv have been made, where can I find those declarations? 11:11:39 s/Art: ??/Art: John, are you aware of any IPR disclosures that have been made for Geopriv?/ 11:11:58 rrsagent, draft minutes 11:11:58 I have made the request to generate http://www.w3.org/2008/12/10-devices-minutes.html matt 11:12:47 s/IPR declarations?/John, are you aware of any IPR disclosures that have been made for Geopriv?/ 11:12:49 rrsagent, draft minutes 11:12:49 I have made the request to generate http://www.w3.org/2008/12/10-devices-minutes.html matt 11:13:10 Topic: APIs, Safety, and User Notifications on The Web, Lucas, Mozilla 11:19:16 tlr: if you only let top-level content do these things, then it might be worth it standardasing those messages passed 11:19:55 DKA has joined #devices 11:19:57 Lucas: suspect that a top-level model won't be enough in the long run 11:20:54 ??: we looked at those asynchronous APIs and we ran into problems. In some circumstances they complete synchonously 11:21:04 s/??/Paddy/ 11:21:05 and it becomes inconvenient for the programmer to handle both cases 11:21:22 and we came to the conclusion that API wouldn't be convenient 11:21:47 ??: do you envisage some way for the site to explain why they need your location? 11:22:14 dougt: in the geolocation spec, we used to have an attribute to synchornously give you the location. 11:22:37 problem is that most devices take time to start, and also you want to ask the user for permission 11:23:03 so we dropped that, and everything is asynchronous, because the user is the decision maker 11:23:24 s/??/Fabio/ 11:23:37 Lucas: you don't want to block the app, hence asynchronous 11:25:19 psd: asynchronous is good because it empowers the user. Lack of accuracy is a feature. A bit worried about my wife useing a location device, she would just turn it off 11:26:02 smb has joined #devices 11:26:10 Lucas: you can have tons of impormation the device asks you 11:26:17 Anil has joined #devices 11:26:26 psd: the beauty of fireeagle, for instance, was that I tell the service where I am 11:26:29 s/impormation/information/ 11:26:37 a kind of push model. 11:27:25 Topic: Geolocation fall-out II: Device APIs in the browser context, by Doug Turner (Mozilla) 11:29:41 seems most geolocation use-cases involve alcohol - I'm drunk, need a taxi, pizza, waking up when my train nears the station 11:31:49 DKA has joined #devices 11:38:18 scribe: pauld 11:38:26 dougt has joined #devices 11:39:11 mahemoff has joined #devices 11:39:25 Topic: dentity/Policy/Trust: Secure access for widgets to resources and privileged APIs by Arve Bersvendsen (Opera Software ASA) 11:39:33 s/dentit/identity/ 11:39:57 s/tityy/tity/ 11:41:30 smb has joined #devices 11:41:56 ArtB - if a Zakim bridge channel is set up we can dial into it. 11:41:58 Arve: widgets I'm talking about aren't OpenSocial/ iGoogle Web based, rather installed desktop/device software 11:45:50 ben_ has joined #devices 11:47:05 jmorris has joined #devices 11:48:14 ???: Adobe model is based on signatures, not origin based identity 11:48:25 .. most widgets based on signatures? 11:49:02 Arve: not dashboard, Yahoo! is the only other signed widget platform I'm aware of 11:49:21 s/???/Lucas/ 11:49:48 x??: an alternative approach is to use registration 11:50:15 s/x??/Randy/ 11:50:18 y??: any thoughts on security around the execution of the script itself? 11:50:23 s/y??/Anil/ 11:51:53 BenLaurie: my project, caja, protects against intermediary attacks 11:53:09 Arve: you can base this from a Web of trust, e.g. foaf, when it comes to mobile, preferred approach is the trusted vendor - application, device, network provider 11:53:33 .. who do you trust enough to allow an application to run without prompts? 11:54:24 q??: do you have a notion of the capabilities a good or bad application may exploit? 11:54:43 two houses, each alike in dignity... 11:54:50 .. are you "just from a noble family" good enough? 11:55:19 s/q??/Fabio?/ 11:55:52 Arve: we're more interested in how to deal with bad applications - making calls to premium rate nos, etc 11:56:06 BenLaurie: revoking a signature following an issue 11:57:14 Zakim has joined #devices 11:57:24 StevenBellovin: it's a reputation thing, a malicious app may have a delayed impact, so. I don't think you get the accountability you really want 11:57:43 q+ paddy, steve, Doug, Lukas, PHB 11:58:02 Arve: trust comes from assured "identity" - not going to pass on credit card details to someone I don't know 11:58:03 ack p 11:58:57 ack paddy 11:59:08 Paddy: we're talking about signatures without understanding what the signatures mean - authenticity, OK, but we shouldn't confuse identity with trust 11:59:29 Arve: the web model is built around certificates 11:59:51 ack steve 11:59:59 tlr: interesting discussion, let's not go down that rabbit hole, just yet! 12:00:27 madofo has joined #devices 12:01:10 q- doug 12:01:17 ack lukas 12:01:19 q+ PHB 12:01:40 Steve: (Nokia) signatures can be used implicitly without having to make them a part of access control - (layered) and a privileged runtime maybe based on where something is installed on the filesystem 12:02:23 ack p 12:02:55 q+ johnmorris 12:03:06 Arve: (in reply to John) geoprivacy is different to, say, payments 12:03:26 ack smb 12:03:30 q+ smb 12:05:45 PHB: bad guys are infinitely capable of generating bad stuff, all data has to be signed - that's cast iron, but how to determine sources of goodness is what we need, and in ways which are compatible with open source. Less interested in "The Web of Trust" than cooperative voting/vouching systems. Web of trust ain't going to defeat the Russian Mafia 12:05:53 Separate the decision of who to trust from enforcement, signatures are about enforcement, we need to move to a default deny mode of security, look for goodness, not badness, Signatures allow you to determine that the code is from your previously determined source of goodness. All code must be signed, some users will decide that code must be signed by trusted sources that meet particular criteria. 12:06:51 John: privacy of me isn't critical, privacy of my child might be. I realise geoprivacy not a big a beast as financial security, but can be 12:07:46 xkcd.com/501 12:08:39 xkcd: classic 12:08:42 StevenBellovin: although people maybe appear not to be trustable, or have reputation, I may still trust them in some cases, e.g. EULA attacks for software such as Bazaar 12:09:13 a??: a signature which is not used is useless 12:09:43 tlr: want to highlight two dimensions wrt to extent of trust 12:09:49 s/Bazaar/Kazaa/ 12:09:55 s/a??/randy/ 12:12:31 .. how can you bring in authentication into the flow of an interaction, then there is the distinction of identity, on the Web the best we seem to have is origin, certificates not transparent or available from the URI location, what is the action the party has to take when trusting code - we're in a general discussion 12:13:34 David: the example of geolocation in jpegs is a slippery slope, where do we stop here? We should be careful of making Geolocation too much of a special case. 12:14:18 PHB: there are a number of methods of finding someone's location beyond the location device, e.g. IP address 12:15:50 q+ lukas, dom 12:15:55 q- john 12:15:56 q- smb 12:16:19 DougT: we have a tremendous UI responsibility, and much of this is middleware, surfacing it is hard! Also, we're sending information to sites who have unclear privacy policies, for retention, etc. 12:17:38 r??: trusted versus trustworthy (runs in a sandbox) is worth highlighting 12:17:50 s/r??/lucas/ 12:18:15 q? 12:18:15 dom: would the privacy concern be bound not just to the device or service but the location? 12:18:18 ack lukas 12:18:19 ack d 12:20:23 John: current location is The most important concern when it comes to privacy 12:20:40 dom: so problem would be less important if the API was less focused on current location 12:23:27 John: many of the ideas discussed sound good - advice in documents on how devices should behave, but I don't see an incompatibility on transmitting rules along with the data. We want APIs to be implemented, and W3C will lead to adoption of *code* without reading the constraints expressed in a spec, which is why we'd advocate sending rules 12:26:11 fhirsch3 has joined #devices 12:26:13 q+ to ponder whether WIdgets are the Web and whether it matters in this context. 12:26:14 .. geopriv in the IETF is a set of requirements to be implemented by other WGs, one binary and one XML based already, you can be compliant so long as you transmit the rules, but we don't define the format. One of the specific documents defining a format doesn't currently have extensibility, but the principle does. Most important questions: who gets the info, how long to retain, who to pass info onto 12:26:25 q? 12:27:03 tlr: we should look less at a specific solutions, but more generic principles 12:27:40 BenLaurie: does retention cover logging? 12:29:46 John: obviously there is data which is implicitly providing location, e.g. IP address. We'd say, yes, for privacy you should periodically dump those logs. There is leakage throughout here, and doesn't prevent man in the middle attacks, it's more aimed at the intended recipient 12:30:18 q? 12:31:27 BenLaurie: an attacker could demand you flush your logs! 12:31:48 -> http://www.w3.org/2008/12/08-geolocation-minutes Geolocation F2F minutes on Day 1 12:33:45 Dan: we should be careful about how we define "widget" - they are potentially a part of the Web, an extension of the Web. A security mechanism which makes sense for the Web. We (Vodafone) don't think it's true there are separate mobile and non-mobile Webs. 12:34:17 lunch engineering discussion 12:35:31 mechanics of dinner: Spaghetti House - details will be online 7pm reservation 30 people 12:41:26 zakim, this will be foo 12:41:27 ok, tlr; I see Team_(foo)13:30Z scheduled to start in 49 minutes 12:42:08 zakim, code? 12:42:08 the conference code is 26632 (tel:+1.617.761.6200 tel:+33.4.89.06.34.99 tel:+44.117.370.6152), tlr 13:00:31 pauld has joined #devices 13:07:34 maxfroumentin has joined #devices 13:12:32 madofo has joined #devices 13:32:58 Team_(foo)13:30Z has now started 13:33:05 + +1.919.676.aaaa 13:35:47 zakim, code? 13:35:47 the conference code is 26632 (tel:+1.617.761.6200 tel:+33.4.89.06.34.99 tel:+44.117.370.6152), tlr 13:36:49 +[Vodafone] 13:42:42 zakim, who is on the phone? 13:42:42 On the phone I see +1.919.676.aaaa, [Vodafone] 13:42:49 zakim, who's making noise? 13:42:59 DKA, listening for 10 seconds I could not identify any sounds 13:43:06 hmmm... 13:43:27 can whoever is on the bridge verify that they can hear anything? 13:43:59 zakim, who's making noise? 13:44:09 DKA, listening for 10 seconds I could not identify any sounds 13:45:59 mahemoff has joined #devices 13:46:16 ArtB has joined #devices 13:46:35 Topic: TiddlyWiki - a resuable non-linear personal web notebook (Paul Downey, Osmosoft.com) 13:48:22 amachin has joined #devices 13:51:10 arve has joined #devices 13:52:28 ScribeNick: dom 13:52:41 MaxF: I really liked TiddlyWiki when I started playing with it after reading the paper 13:53:12 ... You're talking about specific capabilities of the application - e.g. the fact that a file:// resource can be saved on some browsers 13:53:27 ... Do you see room for standardization around this? 13:53:38 PaulD: not around that specifically 13:53:50 ... what we are interested in is what the user sees 13:53:54 marcos has joined #devices 13:54:12 ... There is a lot of variation across browsers on the way the browsers react to these use cases 13:54:14 zakim, who is here? 13:54:14 On the phone I see +1.919.676.aaaa, [Vodafone] 13:54:15 On IRC I see marcos, arve, amachin, ArtB, mahemoff, madofo, pauld, Zakim, jmorris, ben_, dougt, DKA, Anil, matt, Dowan, StewartB, LucasAdamski, AndreaT, MikeSmith, hendry, 13:54:17 ... adrian_hb, RRSAgent, dom, tlr 13:54:19 ... we would like more consistency on this 13:54:38 ... the Web Security Context WG is working around these topics I believe 13:54:53 Ben: Have you seen the Tao@@@ version of TiddlyWiki? 13:55:03 ... Tao@@@ is a distributed file system 13:55:18 ... and they've integrated tiddlywiki on top of it 13:55:48 Paul: I hadn't heard about it - I'm seeing usage of tiddlywiki in surprising places given how convenient it proves 13:56:01 s/Tao@@@/Tahoe/ 13:56:28 Lee: I'm from IBM - presenting the paper wrote by myself and Mary Ellen Zurko 13:56:44 ... we couldn't join the workshop physically 13:56:58 ... we're seeing areas where standardization could help us 13:57:15 ... Mez and I work on the Lotus division; in particular, its mobile version 13:57:24 zakim, aaaa is Lee_Griffin 13:57:24 +Lee_Griffin; got it 13:57:52 ... various areas where device APIs could be useful 13:58:11 ... integrity for the software itself - e.g. to defend against virus 13:58:33 ... relatively easy on windows mobile, by requiring signature of software 13:59:01 ... at the other end of that, Symbian requires that the software provider gets its software signed off by @@@ 13:59:51 ... we need write access to the filesystem (e.g. to keep logs), but the operations we're trying to do are on the safe-side - nothing that would incapacitate the phone 14:00:30 ... Another complex area is identifying the user 14:00:42 ... done today mostly by username/password 14:01:04 ... devices with biometrics are becoming more popular 14:01:10 ... and provide another way for authentication 14:02:43 ... We also need the ability for an administrator to look into a device and see various capabilities / settings 14:03:02 ... we also need to be able to do things to device - e.g. in case it is lost or stolen 14:03:04 fjh has joined #devices 14:03:09 ... Carriers face the same pb today 14:03:26 ... currently it is specific to the manufacturer / OS 14:04:00 ... Finally, we're also very constrained on these devices: there is a trade off between everything and the battery 14:04:22 ... the battery life is the focus of the manufacturers 14:04:53 ... everything needs to be subset as much as possible so that it works even on 1MB phones where no more than 32K of memory can be allocated 14:06:03 PHB has joined #devices 14:10:08 Toipc: Network impact of Web access to device APIs 14:10:14 s/Toipc/Topic/ 14:10:22 s/APIs/APIs (ISOC, Mat Ford) 14:12:32 zakim, pick a victim 14:12:32 Not knowing who is chairing or who scribed recently, I propose [Vodafone] 14:12:44 zakim, this is not useful 14:12:44 sorry, dom, I do not see a conference named 'not useful' in progress or scheduled at this time 14:15:12 scribe: Matt 14:15:24 Scribe: dom 14:20:51 EMScamking has joined #devices 14:21:10 Ben: you talked about sharing IP addresses potentially breaking some apps 14:21:33 ... we have had a recent good example with wikipedia banning 14:22:29 tlr: you mentioned "further" damages - anything damage you had in mind? 14:22:37 mat: NAT? many other examples 14:22:47 PHB: I want to question the @@@ principle 14:23:01 s/@@@/end-to-end/ 14:23:20 ... the end of applications are not in the network - they are people, organizations 14:23:40 ... the end to end principle has led to not putting the security in the right places 14:24:04 Mat: I don't think I disagree with what you said - I mentioned the end-to-end principle as a background information 14:24:14 pauld has left #devices 14:24:23 pauld has joined #devices 14:30:48 maxfroumentin has joined #devices 14:31:13 madofo has joined #devices 14:31:35 luxury, when I were a lad we didn;t have 300MHz, we had 1MHz, and 8-bits too 14:31:44 and 16K RAM 14:31:58 Tell kids today that, they won't believe you 14:32:46 tlr: it wasn't clear to me of divergence between your system and native apps on PC 14:32:50 amachin has joined #devices 14:33:21 stewart: we would like youtube to be able to use a setup box decompression hardware 14:33:36 ... we would need to grant specific right to youtube for this 14:33:43 well we used to call it RAM, it was really just a big process register, but we called it RAM because it was RAM to us 14:33:55 tlr: have you looked at the