17:04:31 RRSAgent has joined #privacy 17:04:31 logging to http://www.w3.org/2016/12/01-privacy-irc 17:04:33 RRSAgent, make logs 263 17:04:33 Zakim has joined #privacy 17:04:35 Zakim, this will be 17:04:35 I don't understand 'this will be', trackbot 17:04:36 Meeting: Privacy Interest Group Teleconference 17:04:36 Date: 01 December 2016 17:04:40 rrsagent, make logs public 17:05:18 present+ 17:05:24 zakim, who is here? 17:05:25 Present: wseltzer 17:05:26 On IRC I see RRSAgent, npdoty, tara, weiler, LCPolan, Andrey_Logvinov, dveditz, yoav, plinss, mounir, rrware, mkwst, adrianba, hadleybeeman, jyasskin, terri, schuki, dustinm, 17:05:26 ... lukasz, Mek, wseltzer, trackbot 17:05:39 present+ tara, npdoty 17:05:44 present+ 17:06:06 Oops - somehow WebEx kicked me off! 17:06:07 That is not helpful! 17:06:33 Ah - okay now. 17:06:37 present+ 17:06:50 present+ jim_lim 17:06:58 present+ lake_polan 17:08:17 scribenick: npdoty 17:08:32 Requests for reviews: 17:08:41 Screen Orientation API 17:08:56 https://lists.w3.org/Archives/Public/public-privacy/2016OctDec/0030.html 17:09:29 agenda: https://lists.w3.org/Archives/Public/public-privacy/2016OctDec/0048.html 17:09:31 chair: tara 17:09:41 IndexedDB API 17:09:48 https://lists.w3.org/Archives/Public/public-privacy/2016OctDec/0031.html 17:09:49 warning, danger lies there 17:09:57 present+ mary_hodder 17:10:12 WebPref: https://lists.w3.org/Archives/Public/public-privacy/2016OctDec/0035.html 17:10:24 q? 17:10:58 wseltzer: brainstorming on how can we get the privacy reviews done for these specs 17:11:17 ... have talked to a few groups that need a real privacy/security considerations explanation in their specs 17:11:35 ... that is, not just "there are no privacy or security considerations" 17:11:50 ... as a small group, we have trouble keeping up with all the specs 17:12:30 ... working on self-review guidelines and then review that just focus on their answers to those questions, could be a more rapid response 17:13:02 ... and start talking with the person who did that self-review and knows the spec technically 17:13:18 ... so that we can get into more detailed questions about cross-origin or sensors with that person 17:14:26 tara: 1) some specs we are getting people who provide the answers to the self-review questionnaire but more of that could improve the review; 2) late-stage specs that haven't looked at the questionnaire may be an issue 17:14:42 wseltzer: sure, 2) is more on W3C, and is getting spread with education and tooling 17:15:10 ... for our reviews on these calls, could we get champions of issues to take the next step of reading and highlighting anything htat looks concerning 17:15:40 tara: we had tried to identify an individual who would solicit comments and move things forward 17:16:03 q+ 17:16:18 ack np 17:16:39 nick: it helps to have the groups fill out the questionnaire but there is more work to be done. 17:17:04 nick: reviewer does have to review the spec in some detail to find the relevant info 17:17:38 tara: +1, reviewer has to look at the spec itself, not just self-review responses 17:17:47 ... to add their own level of analysis or catch issues 17:18:16 q+ 17:18:25 nick: when we have assigned people, have we followed up? 17:19:19 tara: we have had people who would manage responses, but had more of a problem that the group itself didn't contribute answers to compile 17:19:53 wseltzer: can we use Github issues as a way to put pressure on both the WGs and PING? 17:20:27 ... e.g. open a privacy review issue that can't be closed without conducting a privacy review (either by PING or someone else, like a WG member), and PING can point out with comments if a review is not sufficiently detailed 17:21:12 wseltzer: Github is where work is being moved. Director is asking for a disposition of issues at transitions, and groups typically point to their Github issue list 17:22:38 tara: in terms of getting the process happening earlier, is there anything formal / involved with Github, to get this to happen sooner? 17:22:50 wseltzer: having the questionnaires in better shape would help a lot 17:23:16 ... questionnaire should point out that you should have a priv/sec section and it should address your responses to this (per dsinger) 17:23:43 q? 17:23:46 q- 17:23:47 ack ws 17:24:30 npdoty: I only see a timeline request on 1 of the 3 requests that we're looking at 17:25:06 npdoty: can someone follow-up with those groups to ask about their timeline? 17:25:34 tara: Web Payments likely to come back with a group of changes in January 17:25:57 [for example, I note that Screen Orientation doesn't even mention "privacy". that should be an automatic push-back.] 17:26:20 I will go track down deadlines. 17:26:35 https://www.w3.org/wiki/Privacy/Privacy_Reviews 17:27:45 npdoty: wiki is out of date, but it's becoming clear that as the review requests come in more quickly, we either need more volunteers within PING, or need to find ways for reviews to happen within groups 17:27:49 https://github.com/w3c/screen-orientation/issues/96 17:28:16 q+ 17:28:29 ack weiler 17:30:10 weiler: how likely are we to get effective reviews from the group itself? 17:30:49 npdoty: it might be rare to get comprehensive reviews from the author or someone in the group already, but could get quite detailed expertise if they're willing to recruit security/privacy people from their own organizations to conduct a review 17:31:21 weiler: that suggests that maybe we should mention in questionnaires that they may need to ask for expertise not already within the WG 17:31:49 wseltzer: Web Perf a particular area of privacy concern because the focus of the APIs is to gather very detailed data, which could be used for fingerprinting and the like 17:32:04 ... since they're currently revising lots of them, important that they at least have privacy considerations described 17:32:33 ... in some cases just describing features that are already implemented 17:32:55 ... privacy issues can either note that we can't recommend it as implemented, or note the privacy issues for potential implementers who can mitigate in some ways 17:33:44 ... can successfully point out research results that changed certain features 17:34:18 User Data Controls in Web Browsers 17:34:26 https://gist.github.com/mnot/96440a5ca74fcf328d23 17:35:00 i/certain features/Topic: User Data Controls in Web Browsers/ 17:35:13 tara: additional context on mnot's shared doc on user data controls? 17:35:46 wseltzer: Mark shared this document as an evolution from previous conversations with PING 17:36:04 ... expanded from just private browsing modes to looking at different modes more generally 17:36:18 ... describe those modes so that other specs can reference how they should behave in those different modes 17:37:01 ... could adopt this as a PING note for ongoing work 17:37:17 ... and could modify questionnaires/reviews to refer to this document and these modes more specifically 17:37:55 q+ with dsinger's note 17:38:01 q- with 17:38:11 q= 17:38:17 queue= 17:38:41 wseltzer: another privacy review request from dsinger on VTT privacy/security considerations 17:38:56 q+ 17:39:30 npdoty: looking at IndexDb spec 17:40:17 q- 17:40:36 npdoty: IndexedDB group refers to "clear browsing data" and how their spec's data should be handled 17:41:04 ... and I think it would be useful to have a formal description/categorization of the different features across browsers, as opposed to refering to a single name of a feature 17:41:39 Topic: Browser Fingerprinting 17:41:55 tara: nice seeing our group note out there in the wild, being pointed to by Princeton researchers 17:41:56 :) 17:42:23 1. status of document 17:42:29 2. met with EFF folks about directions 17:42:49 Status: needs revisions to make it more actionable for people writing browser specs 17:43:01 What are common sources of fingerprinting (so people can easily identify them) 17:43:23 May also need to weigh pros and cons -- explicitly note that *these* are the factors that are the most concerning, to go into the weighing process 17:43:34 Intend to add them by the end of the year and get PING feedback 17:43:40 EFF feedback: 17:43:57 1. Some fingerprinting work could benefit from prioritizing how we fix those issues. 17:44:18 Since some fingerprinting happens at implementation, versus specs, we can ID the bugs 17:44:37 Making FP detectable is helpful (sometimes prevented) 17:44:46 2. Sometimes we are getting into UI/UX issues 17:44:56 Like - how much information is overload? 17:45:20 Might be helpful to have a meeting to discuss these user-facing issues -- write up some advice 17:45:59 3. Coordination -- we talk about clearing information (e.g., cookies...) but also there is a separate effort in IETF space, about rotation (e.g., of IP address) 17:46:08 We might want to talk about these things at the same time. 17:46:31 q+ 17:46:35 If your IP address rotates at same time at the cookie, then they can be tracked together, but otherwise it may be equivalent to clearing. 17:46:53 So this is a place where we could coordinate layers and groups. 17:46:56 ack sam 17:47:05 ach weile 17:47:06 Sam: how might we cross that layer boundary? 17:47:15 s/ach weiler// 17:47:29 npdoty: IAB folks had talked about number rotations; EFF can help link us up with folks working in that layer of the problem 17:47:38 Use our networks to connect these discussions. 17:47:50 q? 17:47:52 ack w 17:48:23 s/ach weile// 17:48:46 tara: great, plenty of work to do there :) 17:49:19 tara: Privacy Questionnaire question out to Christine, who is currently managing that 17:49:23 Topic: AOB 17:50:08 npd has a workshop on January 12th 17:50:18 Wendy and I are also busy on 12 Jan 17:50:25 q+ 17:51:15 Tentatively Jan 19 but need to consult with Christine. 17:51:40 q- 17:52:11 q+ 17:52:30 ack weiler 17:53:24 npdoty: post-election responses?, besides our work still being important 17:53:51 weiler: might be a key recruitment point on encouraging participation in privacy/security and standardization 17:53:52 +1 17:55:31 tara will follow up on the list with decided time for next meeting 17:55:40 and follow-up on ongoing work items over the holiday 17:55:48 tara: thank you all for your hard work 17:56:07 trackbot, end meeting 17:56:07 Zakim, list attendees 17:56:07 As of this point the attendees have been wseltzer, tara, npdoty, weiler, jim_lim, lake_polan, mary_hodder 17:56:15 RRSAgent, please draft minutes 17:56:15 I have made the request to generate http://www.w3.org/2016/12/01-privacy-minutes.html trackbot 17:56:16 RRSAgent, bye 17:56:16 I see no action items