16:01:10 RRSAgent has joined #privacy 16:01:10 logging to http://www.w3.org/2014/05/29-privacy-irc 16:01:12 RRSAgent, make logs 263 16:01:12 Zakim has joined #privacy 16:01:14 Zakim, this will be 16:01:14 I don't understand 'this will be', trackbot 16:01:15 Meeting: Privacy Interest Group Teleconference 16:01:15 Date: 29 May 2014 16:01:17 npdoty has joined #privacy 16:01:27 Hi all. We'll start in a few minutes. 16:01:47 zakim, this will be 7464 16:01:47 ok, fjh; I see Team_(privacy)16:00Z scheduled to start now 16:02:03 zakim, make logs public 16:02:03 I don't understand 'make logs public', fjh 16:02:11 zakim, who is on the phone? 16:02:11 Team_(privacy)16:00Z has not yet started, jcraig 16:02:13 On IRC I see npdoty, Zakim, RRSAgent, gmandyam, Ryladog, janina, yrlesru, jcraig, fjh, christine, tara, TallTed, terri, trackbot, wseltzer 16:02:17 Thank you fjh 16:02:30 zakim, this is yrlesru 16:02:30 sorry, yrlesru, I do not see a conference named 'yrlesru' in progress or scheduled at this time 16:02:42 Zakim, jcraig is [Apple] 16:02:42 sorry, jcraig, I do not recognize a party named 'jcraig' 16:02:44 rrsagent, please make logs public 16:02:48 MichaelC_ has joined #privacy 16:02:52 Zakim, code? 16:02:52 the conference code is 7464 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), npdoty 16:03:52 Giri, are you on the call? 16:04:21 Yes I am 16:04:36 JoeHallCDT has joined #privacy 16:04:42 zakim, ipcaller.a is me 16:04:42 +fjh; got it 16:04:44 +gmandyam 16:04:45 Zakim, Apple has jcraig 16:04:45 +jcraig; got it 16:04:48 zakim, who is here? 16:04:48 On the phone I see [IPcaller], tara, hober, Katie_Haritos-Shea, [Apple], ??P1, +1.214.566.aaaa, WSeltzer, Michael_Cooper_(IndieUI), [CDT], +44.793.550.aabb, npdoty, terri, fjh, 16:04:51 zakim, ??P1 is me 16:04:52 ... gmandyam 16:04:52 [Apple] has jcraig 16:04:52 On IRC I see JoeHallCDT, MichaelC, npdoty, Zakim, RRSAgent, gmandyam, Ryladog, janina, yrlesru, jcraig, fjh, christine, tara, TallTed, terri, trackbot, wseltzer 16:04:52 +janina; got it 16:04:59 Present+ Frederick_Hirsch 16:05:07 Zakim, [IPcaller] is me 16:05:07 +christine; got it 16:05:44 1. Welcome and introductions 2. Geolocation WG 3. IndieUI WG 4. Privacy guidance and process documents 5. TPAC session 6. AOB 16:05:44 - +1.214.566.aaaa 16:05:45 zakim, who is noisy? 16:05:52 npdoty has changed the topic to: Agenda May 29: http://lists.w3.org/Archives/Public/public-privacy/2014AprJun/0009.html 16:05:56 jcraig, listening for 10 seconds I heard sound from the following: christine (64%), terri (4%) 16:06:07 + +1.214.566.aacc 16:06:09 Hannes_Tschofenig has joined #privacy 16:06:23 zakim this is aaaa 16:06:27 Hi, I'm Janina Sajka, Chair of IndieUI (and also PF in W3C-WAI) 16:06:29 Zakim, mute terri 16:06:29 terri should now be muted 16:06:32 Joe Hall here, chief technologist at the Center for Democracy and Technology, a global online digital civil liberties organization 16:06:38 Michael Cooper, staff contact to IndieUI WG 16:06:39 Giri Mandyam, Qualcomm Innovation Center - joining the PING call to go over Geolocation WG 16:06:45 scribenick: npdoty 16:06:46 Tara Whalen, co-chair of PING, Privacy Engineer at Apple. 16:06:48 Frederick Hirsch, Nokia, Chair DAP 16:07:02 scribenick: JoeHallCDT 16:07:02 Thanks! 16:07:10 Hi, I am Katie Haritos-Shea on IndieUI 16:07:11 zakim, this will be aaaa 16:07:11 I do not see a conference matching that name scheduled within the next hour, yrlesru 16:07:13 done 16:07:36 Zakim, aaaa is yrlesru 16:07:36 sorry, npdoty, I do not recognize a party named 'aaaa' 16:07:38 Agenda item 2 - Geolocation WG 16:07:39 zakim, this will be aacc 16:07:39 I do not see a conference matching that name scheduled within the next hour, yrlesru 16:07:46 Zakim, who is making noise? 16:07:46 sorry, npdoty, I don't know what conference this is 16:07:54 Zakim, this is 7464 16:07:54 ok, npdoty; that matches Team_(privacy)16:00Z 16:07:58 Zakim, who is making noise? 16:08:10 npdoty, listening for 10 seconds I heard sound from the following: gmandyam (64%), +1.214.566.aacc (40%) 16:08:12 Giri, we cannot understand you 16:08:22 Thanks, better 16:08:24 Much better, thanks. 16:08:49 discussing slide 2 16:08:52 Terri Oda, Security Researcher at Intel Open Source Technology Center 16:09:04 Giri: geoloc WG one of the first device API WGs 16:09:08 slides - http://lists.w3.org/Archives/Public/public-privacy/2014AprJun/att-0012/Geolocation_WG_Status_for_PING_May_29_2014.pdf 16:09:14 … specifically for mobile devices in mind 16:09:22 … level 1 spec is the geoloc api 16:09:28 … other level is device orientation 16:09:43 … gyroscope, when the device is in motion, direction it's moving in cartesian coords 16:09:51 … both apis proved to be very popular 16:10:04 … have been interop. issues but lots of vendor take-up 16:10:26 … under the previous charter, attempt for level 2 api 16:10:40 … main feature reverse geocoding… lat/lon of address 16:10:44 … not developer interest 16:10:49 … spec shelved before last call 16:11:21 … Qualcomm Innov. Cntr. does a lot of the mobile chip geoloc stuff 16:11:40 … certainly are privacy concerns 16:11:44 s/spec shelved/reverse address lookup feature was shelved/ 16:11:56 … safety issue, e.g., children exposing their home address 16:12:04 … legal issue, govt. tracking location 16:12:31 … not just a US issue given legal developments, but an issue in repressive nations 16:12:55 … recognized problem with the limited ability for users to control geoloc information through browser api 16:13:19 … users may not have a clue which sites they've given long-term access to geoloc. API 16:13:35 it's also an issue in WebRTC with permissions I believe 16:13:40 +1, not unique to Geolocation! persistence and revocation of permissions is a challenge 16:13:40 that was just me, not as scribe 16:14:07 … doesn't seem like the w3c has a uniform answer across WGs for this 16:14:17 … questions? 16:14:20 … none. 16:14:27 … slide 4 (slides are not numbered) 16:15:12 Slide #5 content: 16:15:13 New Geolocation Working Group Charter 16:15:16 … slide 5, "New Geoloc WG Charter" 16:15:22 Two main work items 16:15:23 – Adding geofencing to Geolocation API 16:15:25 • Leverage HW-based geofencing (as opposed to JS- based geofencing, which is possible with existing API) 16:15:26 – Cleaning up DeviceOrientation specification 16:15:28 • First version of spec resulted in poor interoperability 16:15:29 between different browser implementations 16:15:30 … Qualcomm has impliemented low-power geofencing 16:15:31 • In addition, development of use cases and requirements for indoor location extensions to API 16:15:32 Geofencing: Sample Use Cases 16:15:34 • Alerts when points of interest are in the user's vicinity 16:15:35 • Asset tracking 16:15:36 • Mobile marketing 16:15:37 – Advertisements related to geographical context 16:16:13 (That's actually Slides #5 and #6) 16:16:21 … there were problems with browser implementations of DeviceOrientation 16:16:33 … want to extend to indoor location extensions 16:16:47 q 16:16:50 q+ 16:17:22 … this can specialize information to a specific location in a building (floors, etc.) 16:17:29 … didn't want this to be explicit in the charter 16:17:58 … issues with multiplatform support for that 16:18:19 … geofencing: alerts when points of interest are near 16:18:40 … asset tracking: where is your stuff? 16:19:34 … mobile marketing… ads based on geography and presence 16:20:14 … slide 7: references on identified issues wrt privacy in existing API 16:20:36 q+ to ask about civic address 16:21:03 q+ to ask about exposing geoloc justification to users 16:21:13 JoeHallCDT: what is the technology used to do indoor location? beacons, access points, etc.? 16:21:17 ack jo 16:21:33 q- 16:21:39 q+ 16:21:49 BLE: Bluetooth Low Energy 16:21:50 giri: depends on the technology, we do use bluetooth beacons 16:21:54 … q: how does the indoor loc mojo work? 16:22:14 … wifi AP analytics, also beacons can be used 16:22:55 npdoty: follow up about the address thing 16:23:01 ack np 16:23:01 npdoty, you wanted to ask about civic address 16:23:06 … remember a petition to drop a v2, reverse geocoding 16:23:31 (Has the sound dropped, or aonly for me?) 16:23:35 … are there opportunities to provide less precise information with less UI stuff? 16:23:43 only for you CR 16:23:49 I hear the sound quite well 16:23:56 Now okay 16:24:05 Giri: there is a flag, when set to false, allows the API to work on crude location 16:24:19 enableHighAccuracy flag 16:25:04 … might be difficult to get into a mobile browser 16:25:19 … as to second part of the question, have thought about it as a performance issue. 16:25:23 ack me 16:25:23 jcraig, you wanted to ask about exposing geoloc justification to users 16:25:25 ack joe 16:25:29 I have a question as well about the relationship to the work in the IETF. 16:25:40 q+ hannes 16:25:56 jcraig: there is a related feature missing from the geoloc api 16:26:11 … i.e., an informal justification to the user as to why and app/site wants geoloc 16:26:31 … it is not always entirely obvious why a thing wants access to geoloc 16:26:38 +1 That's sounds like a useful feature to me! 16:26:44 … this could be very useful 16:27:03 +1, I raised that back during v1 16:27:37 I bet that they do not add such functionality 16:27:43 Giri: we reference a report from Berkeley that calls out this as a shortcoming 16:27:59 … how do you deliver this in a generic cross-WG manner 16:28:10 … e.g., WebRTC with browser-to-browser comms. 16:28:20 I think that this is called "the race to the bottom". 16:28:21 the pushback heard then (and heard generally) is that the notification string could be fraudulent or misleading 16:28:22 … how do these video and audio streams stay with an intended recipient 16:28:37 or overloaded with legalese for secondary uses 16:28:39 I totally agree it would be good to give general guidance, since every WG is facing that question 16:28:46 jcraig: this could be optional 16:28:53 … some websites would like to us it. 16:29:08 gmandyam: good advice 16:29:11 s/us it/use it/ 16:29:14 q? 16:29:24 ack ha 16:29:49 Hannes_Tschofenig: some of this is very similar to what we've standardized at IETF 16:30:04 … e.g. relative location is useful in a building 16:30:32 … also looked at privacy protections, wondering if you've looked at that 16:30:39 yeah, more precise indoor location might be a good reason to look at IETF's pidlo location object, as opposed to just a set of address fields 16:31:06 gmandyam: We've looked at the GeoPriv object… we're part of (some industry group Joe hasn't heard of) 16:31:15 http://www.in-location-alliance.com/en/about 16:31:52 … we have to in some sense get certain OS support to extend these features into the browser 16:32:27 … if we can't get two browsers to do something, it's difficult to justify work to do this 16:33:04 Christine: thank you very much, excellent intro to the re-chartered WG 16:33:15 … please keep us apraised of what you're doing 16:33:19 +1, thanks gmandyam! 16:33:37 Topic: IndieUI 16:34:19 Janina 16:34:30 Thanks to PING for inviting me. Thanks for all the good questions. I unfortunately I have sign off now. - Giri 16:34:40 https://dvcs.w3.org/hg/IndieUI/raw-file/default/src/indie-ui-context.html 16:34:48 janina: IndueUI WG is looking for advice from PING 16:35:04 … servers can do a better job for tailoring content to users if users can better specify something 16:35:13 https://dvcs.w3.org/hg/IndieUI/raw-file/default/src/indie-ui-context.html#privacy-model 16:35:28 -gmandyam 16:35:54 … the user is communicating preferences and this effort would tailor content to the user according to those prefs 16:36:12 … discloses possibly who this is and their preferences 16:36:16 https://dvcs.w3.org/hg/IndieUI/raw-file/default/src/indie-ui-context.html#privacy-model 16:37:07 … some of these settings are available… but not in a standard way 16:37:51 … caption styling is a big use case 16:38:33 … this spec has a justification string (like that just discussed for Geoloc) 16:38:54 … optional in some cases, required in some high-security preferences 16:39:05 q+ high-security preference example? 16:39:35 q+ to ask about high-security preferences 16:40:39 … media settings, like closed-caption styling, are probably not high-security preferences 16:42:07 … high-security preferences are ones where a user may want to trust certain sites with that info. and not others 16:42:08 is curious about the accessibility restrictions for Google Docs, though I'll look into that offline 16:42:21 … we aim to publish first draft of user preferences doc in late June 16:42:26 q? 16:42:39 ack 16:42:40 ack jo 16:42:40 JoeHallCDT, you wanted to ask about high-security preferences 16:42:41 I think the idea was that screenreader-in-use would likely to be higher privacy because it wouldn't generally needed and might be very sensitive 16:43:44 q+ 16:43:52 q+ 16:44:16 q+ to discuss fingerprinting 16:44:31 npdoty: some things, captions, are things that can be done on the client side 16:44:43 … the server may not need to participate in this 16:44:55 q- 16:44:56 … have we thought about which of these cases need to have the server knowing prefs? 16:45:07 jcraig: all is happening on client-side, so up to web applications 16:45:07 hober has joined #privacy 16:45:21 https://dvcs.w3.org/hg/IndieUI/raw-file/default/src/indie-ui-context.html#userMediaSettings 16:45:24 (was unprecise in describing "server" when web app JavaScript is also a case) 16:45:29 5.3.1 Key: subtitles 16:45:30 Web authors using a native video player should allow subtitles to be displayed natively. Web authors using a custom subtitle view should display the custom-rendered subtitles based on this setting. 16:45:30 Zakim, who is on the phone? 16:45:30 On the phone I see christine, tara, hober, Katie_Haritos-Shea, [Apple], janina, WSeltzer, Michael_Cooper_(IndieUI), [CDT], +44.793.550.aabb, npdoty, terri (muted), fjh, 16:45:33 ... +1.214.566.aacc 16:45:33 [Apple] has jcraig 16:45:33 … the use case npdoty talks about is only when you use an HTML5