16:47:59 <RRSAgent> RRSAgent has joined #privacy
16:47:59 <RRSAgent> logging to http://www.w3.org/2015/01/15-privacy-irc
16:48:01 <trackbot> RRSAgent, make logs 263
16:48:03 <trackbot> Zakim, this will be
16:48:03 <Zakim> I don't understand 'this will be', trackbot
16:48:04 <trackbot> Meeting: Privacy Interest Group Teleconference
16:48:04 <trackbot> Date: 15 January 2015
16:48:06 <npdoty> rrsagent, make logs public
16:48:14 <npdoty> Zakim, this will be 7464
16:48:14 <Zakim> ok, npdoty; I see Team_(privacy)17:00Z scheduled to start in 12 minutes
16:48:28 <npdoty> npdoty has changed the topic to: Privacy Interest Group, 15 January, http://lists.w3.org/Archives/Public/public-privacy/2015JanMar/0002.html
16:52:32 <moneill2> moneill2 has joined #privacy
16:54:13 <__> __ has joined #privacy
16:55:10 <Zakim> Team_(privacy)17:00Z has now started
16:55:17 <Zakim> +[IPcaller]
16:55:36 <moneill2> zakim, [IPCaller] is me
16:55:36 <Zakim> +moneill2; got it
16:56:08 <Zakim> +??P0
16:57:36 <Zakim> +npdoty
16:58:04 <Joanne> Joanne has joined #privacy
16:58:23 <fjh> fjh has joined #privacy
16:58:28 <Zakim> + +1.650.944.aaaa
16:58:48 <Zakim> +WSeltzer
16:58:53 <tara> zakim, aaaa is me
16:58:53 <Zakim> +tara; got it
16:58:56 <Hannes> Hannes has joined #privacy
16:59:35 <Zakim> + +44.793.550.aabb
16:59:35 <wseltzer> zakim, who is on the phone?
16:59:35 <Zakim> On the phone I see moneill2, ??P0, npdoty, tara, WSeltzer, +44.793.550.aabb
17:00:08 <moneill2> hi Simon
17:00:27 <rigo> rigo has joined #privacy
17:00:27 <npdoty> Zakim, aabb is SimonRice
17:00:27 <Zakim> +SimonRice; got it
17:00:28 <Zakim> +[IPcaller]
17:00:33 <chaals> zakim, [ip is me
17:00:33 <Zakim> +chaals; got it
17:00:41 <Zakim> + +49.162.102.aacc
17:01:22 <Zakim> + +33.6.95.66.aadd
17:01:23 <npdoty> chair: tara
17:01:37 <Zakim> +Rigo
17:01:58 <christine> christine has joined #privacy
17:01:58 <tara> Just giving people a few more minutes...
17:02:03 <Zakim> +[IPcaller]
17:02:14 <srice_> srice_ has joined #privacy
17:02:16 <wseltzer> zakim, aacc is mkwst
17:02:16 <Zakim> +mkwst; got it
17:02:19 <fjh> zakim, code?
17:02:19 <Zakim> the conference code is 7464 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), fjh
17:02:31 <Zakim> +[IPcaller.a]
17:02:32 <Zakim> +Joanne
17:02:41 <fjh> zakim, ipcaller.a is me
17:02:41 <Zakim> +fjh; got it
17:02:44 <chaals> zakim, [ip is Christine
17:02:44 <Zakim> +Christine; got it
17:03:07 <rigo> zakim, aadd is Karima
17:03:07 <Zakim> +Karima; got it
17:03:15 <wseltzer> zakim, who is here?
17:03:15 <Zakim> On the phone I see moneill2, ??P0, npdoty, tara, WSeltzer, SimonRice, chaals, mkwst, Karima, Rigo, Christine, fjh, Joanne
17:03:18 <Zakim> On IRC I see srice_, christine, rigo, Hannes, fjh, Joanne, moneill2, RRSAgent, tara, Zakim, npdoty, chaals, TallTed, terri, hadleybeeman, wseltzer, trackbot
17:03:38 <npdoty> Zakim, who is making noise?
17:03:43 <rigo> zakim, who is Darth Vader?
17:03:43 <Zakim> I don't understand your question, rigo.
17:03:47 <chaals> scribe: chaals
17:03:50 <Zakim> npdoty, listening for 10 seconds I heard sound from the following: ??P0 (14%), npdoty (57%), tara (3%), chaals (57%)
17:04:01 <rigo> => Darth Doty
17:04:17 <tara> Thanks chaals!
17:04:41 <chaals> agenda?
17:05:00 <kboudaou> kboudaou has joined #privacy
17:05:02 <tara> 1. Welcome and introductions
17:05:09 <tara> 2. Article 29 WP Opinion regarding device fingerprinting [1]
17:05:21 <Zakim> + +1.415.341.aaee
17:05:24 <christine> Regrets, Frank Dawson
17:05:30 <chaals> agenda+ Welcome / intros
17:05:34 <Zakim> + +1.609.535.aaff
17:05:37 <chaals> agenda+ Article 29
17:05:41 <Joanne> aaee is Rebecca
17:05:50 <tara> agenda + Article 29 WP Opinion regarding device fingerprinting [1]
17:05:57 <wseltzer> zakim, aaee is Rebecca
17:05:57 <Zakim> +Rebecca; got it
17:06:00 <chaals> zakim, drop item 2
17:06:00 <Zakim> agendum 2, Article 29, dropped
17:06:01 <Zakim> +Katie_Haritos-Shea
17:06:02 <tara> agenda +Draft privacy and security questionnaire [2]
17:06:03 <fjh> Present+ Frederick_Hirsch
17:06:12 <christian> christian has joined #privacy
17:06:13 <tara> agenda + TAG draft finding - Transitioning the Web to HTTPS [3]
17:06:15 <fjh> Regrets+ Frank Dawson
17:06:19 <Ryladog> Ryladog has joined #privacy
17:06:23 <tara> agenda + Recent developments in privacy - open discussion and information sharing
17:06:26 <mkwst> mkwst has joined #privacy
17:06:31 <fjh> s/Frank Dawson/Frank_Dawson/
17:06:32 <npdoty> Zakim, who is on the phone?
17:06:32 <Zakim> On the phone I see moneill2, ??P0, npdoty, tara, WSeltzer, SimonRice, chaals, mkwst, Karima, Rigo, Christine, fjh, Joanne, Rebecca, +1.609.535.aaff, Katie_Haritos-Shea
17:06:57 <tara> Thanks for tip!
17:07:07 <npdoty> Zakim, ??p0 is Hannes
17:07:07 <Zakim> +Hannes; got it
17:07:26 <chaals> q+
17:07:47 <npdoty> moneill2: Mike O’Neill
17:07:51 <chaals> MO'N: Mark O'Neill, normally on TPG group and can't do these calls
17:07:59 <chaals> s/Mark/Mike/
17:07:59 <wseltzer> s/Mark/Mike/
17:08:09 <chaals> ack me
17:08:56 <wseltzer> zakim, who is making noise?
17:09:00 <chaals> CMN: I am chaals, and that is a more or less unique personal identifier so you can find more about me. This is first call
17:09:06 <Zakim> wseltzer, listening for 10 seconds I heard sound from the following: tara (90%), SimonRice (30%)
17:09:19 <rigo> zakim, mute chaaaaaaaaaaaaaaaaaaaaaals
17:09:19 <Zakim> sorry, rigo, I do not know which phone connection belongs to chaaaaaaaaaaaaaaaaaaaaaals
17:09:37 <chaals> SR: Simon Rice. Group manager of technology team in data regulator in UK
17:09:43 <wseltzer> mkwst: Mike West, Google chrome security team
17:09:51 <chaals> … Advise the people who make the regulations, so we hope they are technically sound.
17:10:06 <chaals> zakim, next item
17:10:07 <Zakim> agendum 1. "Welcome / intros" taken up [from chaals]
17:10:12 <chaals> zakim, take up item 2
17:10:12 <Zakim> agendum 2. "Article 29" taken up [from chaals]
17:10:16 <chaals> Topic: Article 29
17:10:20 <npdoty> http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf
17:10:23 <tara> http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf
17:10:37 <chaals> SR: This is about device fingerprinting. In 2011 the European directive came into force.
17:11:02 <chaals> … article 5.3 says accessing or storage on the user's device requires consent of the user - the so-called cookie law
17:11:06 <chaals> s|http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf||
17:11:18 <chaals> s|http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf|-> http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf the decision
17:11:48 <chaals> … SO now there is improved attention to this, and to Do Not Track. But it is about information being stored on terminals, not just user data.
17:11:52 <Ryladog> When there is time Simon, what is the name of the DPA in the UK where you work?
17:11:54 <chaals> s/now/now in Europe/
17:12:29 <chaals> … In the last couple of years attention hass been drawn to device fingerprinting. Since it doesn't require storing information as a cookie, the cookie-law is thought not to apply.
17:12:40 <chaals> … But our case is that this covers any storage, not just HTTP cookies
17:12:55 <chaals> … So our intent is to clarify that device fingerprinting does require consent.
17:13:24 <chaals> … The practice is perhaps even more intrusive or anti-user than cookies - at least cookies have a discoverable trace and can be changed.
17:13:45 <chaals> … It is hard to change a device fingerprint. And it can be generated by different parties.
17:13:58 <chaals> … So we see fingerprinting being perhaps more intrusive than tracking.
17:14:25 <chaals> … There are valid exemptions to the requirement for consent under this bit of law. If the use is strictly necessary for something the user asked to do.
17:14:57 <chaals> … We construe that very narrowly. E.g. If you use a cookie for a shopping basket, that is strictly necessary - and has been explicitly requested.
17:15:13 <moneill2> Simon, logging in (authentication) strictlt nec. also?
17:15:14 <chaals> … Another exemption is if the storage is for the sole purpose of doing what people have asked to do.
17:16:01 <chaals> … So we have put out a paper giving some practical guidance, both to site operators and people interested in the policy.
17:16:41 <chaals> … We highlight things such as Mac addresses of network controllers being necessary and therefore  exempt from consent requirements.
17:16:54 <chaals> … Or if there is a specific requirement for identifying a specific user, such as a bank account.
17:17:09 <wseltzer> q+ to ask if licensing needs to be disclosed
17:17:17 <chaals> … And there are categories where we see requirements for consent, such as tracking for online behavioural advertising.
17:17:53 <chaals> … Under the strict reading, the advertising isn't explicitly requested by the user, so consent is required.
17:18:29 <chaals> … With Cookies there isn't a huge real risk in the case of 1st?? party tracking and analytics. Not clear if it is worse in the case of using device fingerprinting.
17:18:40 <chaals> … So what might be interesting to this group?
17:18:54 <npdoty> s/1st??/1st/
17:18:58 <chaals> … How cookies, fingerprinting, etc can not be misused - how can we provide greater control for the users?
17:19:34 <chaals> … The browser is a good place to manage cookie preferences. They are difficult to manage, if you have lots of them, but fingerprinting is still far less transparent.
17:20:05 <chaals> … If we look at geolocation API, and you're asked if you want to let a site get location at will, that's an example of how we can help put users back in control of what is exported.
17:20:16 <chaals> q?
17:20:18 <moneill2> +q
17:20:27 <chaals> s/+q/q+/
17:20:35 <chaals> Tara: Thanks for that overview.
17:20:36 <Ryladog> q+
17:20:54 <wseltzer> ack moneill
17:20:54 <chaals> ack mon
17:21:27 <chaals> MO'N: Wanted to ask how embedded 3rd parties are viewed. Is it the websites responsibility to get consent for fingerprinting done by the 1st party?
17:21:34 <christine> +q
17:21:34 <chaals> s/1st/3rd/
17:21:40 <chaals> s/+q/q+
17:22:10 <chaals> … And how do you characterise Google analytics, which uses a 1st party cookie then transmits it to another server. Does that require consent?
17:22:40 <chaals> SR: On the first one, the advice is like the ITO's cookie guidance. It is the party who is processing teh data that has the legal requirement to get the consent, i.e. generally the 3rd party.
17:22:56 <chaals> … But in most cases the 1st party  will share responsibility because they have the interaction with the user.
17:23:05 <npdoty> q+ to ask about header enrichment
17:23:12 <chaals> … So you expect them to say who the 3rd party is...
17:23:31 <chaals> … If the 1st party incoroporated the 3rd party, it vbecomes the 1st party's responsibility.
17:23:51 <chaals> … 1st and 3rd parties are not clear terms. Analytics we would view as being done by the website operator.
17:24:19 <chaals> … It can be the case that Google Analytics does analysis of a single site, but if it is shared across sites we would treat it as a 3rd party.
17:24:26 <tara> ack wseltzer
17:24:26 <Zakim> wseltzer, you wanted to ask if licensing needs to be disclosed
17:25:09 <chaals> WS: Interested in the second exception - use for licensing or security purposes. Is there required disclosure to the user that the fingerprint will be used?
17:25:32 <chaals> SR: It is clear in the legislation that the exemption is from the requirement for consent, but the user must still be informed that this is taking place.
17:25:59 <chaals> ack ryla
17:26:07 <wseltzer> zakim, mute me
17:26:07 <Zakim> WSeltzer should now be muted
17:26:12 <wseltzer> ack Ryladog
17:26:17 <chaals> zakim, unmute khs
17:26:17 <Zakim> sorry, chaals, I do not know which phone connection belongs to khs
17:26:25 <chaals> zakim, unmute katie
17:26:25 <Zakim> Katie_Haritos-Shea was not muted, chaals
17:26:38 <chaals> KHS: (talking to myself)
17:26:48 <chaals> s/(talking to myself)//
17:26:57 <chaals> … Who is the DPA you work for?
17:26:58 <SimonRice> https://ico.org.uk
17:27:26 <chaals> KHS: Couldn't the first party use an SLA with a 3rd party?
17:27:34 <chaals> SR: It's possible.
17:27:56 <chaals> s|https://ico.org.uk|-> https://ico.org.uk Info commissioner's office|
17:28:06 <rebecca> rebecca has joined #privacy
17:28:15 <chaals> … But the legislation isn't about a controller/processor relationship, anyone getting information has the obligations.
17:28:20 <tara> ack christine
17:28:53 <chaals> CR: We're working on guidance for web spec authors about device fingerprinting.
17:29:09 <tara> ack npdoty
17:29:09 <Zakim> npdoty, you wanted to ask about header enrichment
17:29:40 <chaals> ND: Especially interested in the opinion that accessing data on the device for fingerprinting would be the same as storing a cookie.
17:30:06 <chaals> … My specific question was another way to accomp;ish this - there has been a lot of discussion about header enrichment, inserting data into outgoing traffic.
17:30:30 <chaals> … which is then read by the webpage, who can correlate it with information stored by the ISP inserting it…
17:30:35 <chaals> … is that covered?
17:30:54 <chaals> SR: It isn't accessiing or storing information on the device, but it is interfering with the communications and changing the message.
17:31:23 <chaals> … So it depends how you read the legislation. There may well be valid exemptions that can be applied there to allow such an operation - the most likely being with the consent of the user.
17:31:42 <Hannes> q+
17:31:52 <chaals> … But doing it without the user knowing, I suspect is in breach although I can't point to one off-hand in section 5.3 - think it would be in other parts of the legislation.
17:31:57 <tara> ack Hannes
17:32:06 <chaals> Hannes: Wondering about enforcement actions for cookie laws.
17:32:15 <chaals> … Are there any examples of enforcement action?
17:32:36 <chaals> SR: On the cookie side there have been some fines issued, I believe in Spain.
17:32:42 <alina> alina has joined #privacy
17:32:42 <npdoty> I’m curious about that too. especially if fingerprinting is also considered under the same directive
17:33:10 <chaals> … Not the same level as for other privacy infringements, but there has been enforcement action. We have also written strongly-worded letters to website operators and worked with them on making a sufficient effort to get it right.
17:33:13 <rigo> q+ to ask how would one collect consent for fingerprinting and whether this is covered by the cookie banners
17:33:19 <chaals> … So far the softer approach has had the right effect for us.
17:33:47 <chaals> … Could also happen with device fingerprinting, but it is more difficult when things are done on the server to get evidence of what is happening.
17:34:12 <moneill2> +q
17:34:18 <chaals> Yu can view the traffic leaving the device, but is a screen resolution to optimise layout or fingerprint the device? You need to look into the server to find out, but it hasn't been ruled out.]
17:34:24 <tara> ack rigo
17:34:24 <Zakim> rigo, you wanted to ask how would one collect consent for fingerprinting and whether this is covered by the cookie banners
17:34:26 <chaals> s/Yu/… You/
17:35:01 <chaals> RW: If fingerprinting gets through the 5.3 rule, how is consent handled? Is it sufficient to have it in general usage rules? And how will this change in the new regulation?
17:35:29 <chaals> SR: In terms of practically getting consent, we don't want a banner to accept cookies, then another for a fingerprint, and another for some more fingerprinting...
17:36:04 <chaals> … But there is no reason wy a website cannot include device fingerprinting in the same step as consent for cookies - e.g. by increasing the amount of information and scope of the existing request.
17:36:30 <wseltzer> [why shouldn't it be a more onerous exercise, given the greater difficulty of clearing a device fingerprint?]
17:36:30 <chaals> … In the new regulation, in the ePrivacy directive (europe), the commission are looking at that and may well start a review.
17:36:33 <npdoty> I guess it depends whether we expect “device fingerprinting” to be a common activity for web sites
17:36:47 <chaals> … Once the data protection directive has gone through its reform process.
17:36:50 <tara> ack moneill
17:37:04 <chaals> MO'N: Just pointing to ?? fingerprinting.
17:37:10 <chaals> s/??/detecting/
17:37:15 <Zakim> -tara
17:37:39 <tara> Sorry, my phone just cut off! Christine, can you step in until I show up again?
17:37:43 <chaals> … Headers normally don't give enough to detect an individual. Normally you have Javascript in the page doing the work, and normally using cookies.
17:37:53 <npdoty> there is research being done on detecting fingerprinting (a lot in Belgium, for example, I think)
17:38:11 <npdoty> and we consider detectability of fingerprinting a level of success in mitigation
17:38:17 <chaals> … So that comes clearly under the existing rules. If they didn't use cookies they would have to use e.g. XHR or send the data with a POST. Each of which is detectable.
17:38:41 <mkwst> moneill2, npdoty: Passive fingerprinting techniques (p0f, for example) are fairly advanced.
17:38:45 <chaals> SR: Sure. You see the traffic going across the wire, or the processing in the browser. It isn't completely covert, but is more complex than looking for a cookie.
17:39:01 <chaals> … Tying that to processing to determine if it is exempt is therefore also more complicated.
17:39:06 <chaals> CR: Timecheck.
17:39:18 <Zakim> + +1.613.304.aagg
17:39:20 <chaals> q+
17:39:22 <christine> q?
17:39:38 <chaals> zakim, aagg is tara
17:39:38 <Zakim> +tara; got it
17:39:39 <wseltzer> p0f -> http://lcamtuf.coredump.cx/p0f3/
17:39:42 <chaals> q-
17:40:23 <npdoty> I guess it’s harder for us to measure whether purely passive fingerprinting is taking place as frequently :)
17:40:37 <chaals> CMN: Finding out whether outbound traffic is for legitimate or exempt tracking is orders of magnitude harder than finding cookies
17:40:39 <mkwst> npdoty: harder -> impossible. :)
17:40:58 <chaals> Tara: Thanks Simon. ANy questions from you to us?
17:41:16 <chaals> SR: I have been lurking for a while, and wondering about the future. We should get a little more involved. Is there anything we can do there?
17:41:29 <chaals> Tara: Yes, please participate further.
17:41:34 <chaals> zakim, close this item
17:41:34 <Zakim> agendum 2 closed
17:41:36 <Zakim> I see 5 items remaining on the agenda; the next one is
17:41:36 <Zakim> 1. Welcome / intros [from chaals]
17:41:41 <tara> zakim, take up item 3
17:41:41 <Zakim> agendum 3. "Article 29 WP Opinion regarding device fingerprinting" taken up [from 1 via tara]
17:41:42 <chaals> zakim, close item 2
17:41:44 <Zakim> agendum 2, Article 29, closed
17:41:44 <Zakim> I see 5 items remaining on the agenda; the next one is
17:41:44 <Zakim> 1. Welcome / intros [from chaals]
17:41:49 <wseltzer> ack mkwst
17:41:52 <chaals> zakim, close item 3
17:41:52 <Zakim> agendum 3, Article 29 WP Opinion regarding device fingerprinting, closed
17:41:54 <Zakim> I see 4 items remaining on the agenda; the next one is
17:41:54 <Zakim> 1. Welcome / intros [from chaals]
17:41:58 <chaals> zakim, close item 1
17:41:58 <Zakim> agendum 1, Welcome / intros, closed
17:41:59 <Zakim> I see 3 items remaining on the agenda; the next one is
17:41:59 <Zakim> 4. Draft privacy and security questionnaire [from 2 via tara]
17:42:13 <chaals> Topic: Privacy Security questionnaire draft
17:42:16 <tara> https://mikewest.github.io/spec-questionnaire/security-privacy/
17:42:29 <Zakim> -Rebecca
17:42:45 <chaals> MW: Believe you talked about this. It's a strawman questionnaire spec authors should read to understand some possible privacy/security issues their spec might run into.
17:42:54 <chaals> … haven't touched this since November.
17:43:09 <chaals> … Seems necessary when we write specs to do a better job reviewing specs early on.
17:43:34 <chaals> … On Chromium we sometimes find we haven't seen a feature until it has already been implemented which is very late to successfully get changes made.
17:43:47 <chaals> … Same applies to specs in working groups.
17:44:06 <chaals> … So we are trying to help groups "self-evaluate" with the questions we would ask if we were doing the review.
17:44:18 <npdoty> are there examples of features that have been rejected for privacy reasons because of that too-late-in-the-process-to-change status? that is a sad outcome for all of us, I think
17:44:28 <chaals> s|https://mikewest.github.io/spec-questionnaire/security-privacy/|-> https://mikewest.github.io/spec-questionnaire/security-privacy/ the draft questionnaire|
17:44:48 <chaals> … The goal isn't to block features, but to help spec authors who aren't privacy experts think about issues.
17:45:23 <chaals> … This often obviates the need for a review, because the developers figure out the issue before we get there, and ask us the right questions in advance.
17:46:29 <npdoty> q+
17:46:29 <christine> q+
17:46:33 <chaals> … There are a couple of documents floating around with similar ideas. I am not bound to this document, but looking to collaborate, and get a feel for work happening and how we can get together to produce better understanding of impact of features put in specs, and getting the discussion/analysis to happen early in the process rather than when it is too late...
17:46:37 <wseltzer> ack np
17:47:27 <christine> q-
17:47:29 <chaals> ND: Think this is great work - thanks. Agree that the early review is good, and this is similar to work we have been doing here and collaborating would be good. Hannes has worked on a privacy considerations document.
17:47:49 <chaals> … Frank Dawson was looking at process implications, and you talk about how to identify topics before the reviewers come along.
17:47:59 <christine> q+
17:48:04 <rigo> mkwst: Have you looked into http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/privacy-and-data-protection-by-design ?
17:48:05 <chaals> [+1 to Nick]
17:48:21 <mkwst> rigo: I haven't. But I will!
17:48:40 <chaals> MW: Are there specific features that have ???
17:48:57 <npdoty> rejected for implementation because of privacy issues
17:49:35 <chaals> … There are. In the middle of last year, since blink has ?? mailing list blink-dev we ????. They proposed a feature @@a, that gave too much access to network an device info, useful for fingerprinting and targetting specific devices.
17:49:44 <npdoty> Network Service Discovery
17:49:46 <Hannes> My first impression was that the ENISA document is unfortunately not very relevant for this work. It is more a list of PET, which are not necessarily easy to apply at the level of what the W3C does in the specification work
17:49:58 <Hannes> q+
17:50:03 <chaals> … A mitigation we asked for was a @@b check to ensure the device was explicitly participating and *wanted* to be discovered.
17:50:13 <wseltzer> s/@@b/CORS pre-flight/
17:50:16 <chaals> … That was a good example of how this was meant to work.
17:50:35 <chaals> ND: Think we talked to the network service discovery group about these concerns too.
17:50:37 <wseltzer> s/@@a/network service discovery/
17:50:39 <tara> ack ch
17:50:50 <rigo> Hannes: in the second half of the document, it becomes very concrete and asks the right questions
17:51:23 <tara> ack ha
17:51:33 <chaals> CR: To reiterate, we decided this call would not have specific discussion of ongoing work items. In February we want to get back onto privacy considerations document and others. It would be useful to have you on that call Mike.
17:51:44 <chaals> Hannes: I looked at Mike's document - has some good examples that would improve our document.
17:52:08 <christine> q+
17:52:11 <chaals> … happy to work together on stealing his ideas^W^W^W collaborative improvements.
17:52:28 <chaals> Tara: We were hoping to have Mnot here, but not today.
17:52:35 <chaals> zakim, close this item
17:52:35 <Zakim> I do not know what agendum had been taken up, chaals
17:52:39 <chaals> zakim, agenda?
17:52:39 <Zakim> I see 3 items remaining on the agenda:
17:52:39 <npdoty> +1, thanks mkwst and SimonRice
17:52:40 <Zakim> 4. Draft privacy and security questionnaire [from 2 via tara]
17:52:40 <Zakim> 5. TAG draft finding - Transitioning the Web to HTTPS [from 3 via tara]
17:52:40 <Zakim> 6. Recent developments in privacy - open discussion and information sharing [from tara]
17:52:50 <chaals> zakim, close item 4
17:52:50 <Zakim> agendum 4, Draft privacy and security questionnaire, closed
17:52:51 <Zakim> I see 2 items remaining on the agenda; the next one is
17:52:51 <Zakim> 5. TAG draft finding - Transitioning the Web to HTTPS [from 3 via tara]
17:52:59 <wseltzer> q+
17:53:01 <chaals> Topic: TAG draft finding on HTTP and HTTPS.
17:53:25 <Zakim> -Joanne
17:53:28 <mkwst> I'd also suggest that folks take a look at https://w3c.github.io/webappsec/specs/powerfulfeatures/ in the context of Mark/TAG's document.
17:53:32 <chaals> CR: Maybe Mark will be available for next call, There has been a lot of discussion on the email list - would be nice if someone can try to gather a summary and work to developing a consensus view...
17:53:38 <npdoty> what is the timing on the TAG item?
17:53:49 <wseltzer> ack wseltzer
17:54:00 <christine> q-
17:54:22 <mkwst> q+
17:54:32 <chaals> WS: Believe the TAG wants to wrap this document before the next PING call. Would urge individuals with comments to share them directly with Mark and the TAG.
17:54:52 <chaals> MW: TAG document is a relatively high-level position statement.
17:55:22 <chaals> … Technical implications are being outlined in the Requirements for Powerful Features doc in teh WebApSec document, which will take more time to finish - and feedback on that would be welcome too.
17:55:35 <npdoty> but the HTTPS transition is going to important for privacy, not just on JavaScript APIs
17:55:48 <moneill2> +q
17:55:49 <chaals> Topic: Hot items in the last minute?
17:55:55 <wseltzer> ack mk
17:55:58 <wseltzer> ack mo
17:56:10 <npdoty> q+
17:56:18 <mkwst> npdoty: certainly. but there are certainly privacy implications of APIs like geolocation, which feeds into the desire to restrict them to secure connections.
17:56:38 <chaals> MO'N: Connected to HTTPS everywhere, there seems to be something going on with a clash between a need for security/privacy and the need for police etc to be able to detect bad things happening.
17:56:52 <chaals> q+
17:56:53 <tara> q?
17:57:10 <chaals> … can see a train coming through the tunnel
17:58:00 <mkwst> moneill2: In order to monitor a device's communications, the device's owner should exert administrative control and install a trusted root certificate.
17:58:07 <mkwst> (imho)
17:58:08 <tara> Yes, I saw that (Cameron)!
17:58:10 <chaals> ND: Thinking about related things - Cameron talking about outlawing certain types of encryption out of security fears.
17:58:31 <chaals> … TAG has talked about this, but there is a question of integrity as well as confidentiality.
17:59:13 <chaals> … It's also useful for e.g. Header enrichment and the like. Had the discussion in DNT where people are worried about headers being introduced that way.
17:59:27 <tara> ack np
17:59:47 <tara> ack ch
17:59:53 <npdoty> chaals: social/society making their own decisions, rather than enforced by technologists externally
18:00:08 <npdoty> … important to look at what different societies are trying to achieve, and not make decisions that limit their ability to do so
18:00:29 <chaals> Topic: Next call…
18:00:29 <npdoty> wise words to wrap up for us, chaals
18:00:47 <chaals> Tara: In about a month, end of February? I am not available mid-Feb. Last week of Feb?
18:01:03 <npdoty> February 19?
18:01:04 <mkwst> wseltzer: "Requirements for Powerful Public Servants"?
18:01:20 <wseltzer> mkwst++
18:01:21 <mkwst> wseltzer: Perhaps we can add a quick deliverable to the webappsec charter? :)
18:01:22 <npdoty> February 26?
18:01:25 <chaals> CR: Any objections to 26 Feb?
18:01:41 <moneill2> bye
18:01:43 <Zakim> -chaals
18:01:44 <Zakim> -mkwst
18:01:44 <Zakim> -Katie_Haritos-Shea
18:01:46 <Zakim> -Rigo
18:01:47 <Zakim> -npdoty
18:01:47 <Zakim> -tara
18:01:48 <Zakim> -Hannes
18:01:48 <Zakim> -Karima
18:01:50 <Zakim> -WSeltzer
18:01:50 <Zakim> -SimonRice
18:01:52 <Zakim> -fjh
18:01:52 <Zakim> -Christine
18:01:55 <kboudaou> bye
18:02:00 <rigo> rrsagent, please draft minutes
18:02:00 <RRSAgent> I have made the request to generate http://www.w3.org/2015/01/15-privacy-minutes.html rigo
18:02:07 <rigo> rrsagent, set log public
18:02:42 <npdoty> trackbot, end meeting
18:02:42 <trackbot> Zakim, list attendees
18:02:42 <Zakim> As of this point the attendees have been moneill2, npdoty, +1.650.944.aaaa, WSeltzer, tara, +44.793.550.aabb, SimonRice, [IPcaller], chaals, +49.162.102.aacc, +33.6.95.66.aadd,
18:02:45 <Zakim> ... Rigo, mkwst, Joanne, fjh, Christine, Karima, +1.415.341.aaee, +1.609.535.aaff, Rebecca, Katie_Haritos-Shea, Hannes, +1.613.304.aagg
18:02:50 <trackbot> RRSAgent, please draft minutes
18:02:50 <RRSAgent> I have made the request to generate http://www.w3.org/2015/01/15-privacy-minutes.html trackbot
18:02:51 <trackbot> RRSAgent, bye
18:02:51 <RRSAgent> I see no action items