| Security
homeThe work in the W3C Security Activity currently comprises two Working Groups, the Web Security Context Working Group and the XML Security Working Group.
The Web Security Context Working Group focuses on the challenges that arise when users encounter currently deployed security technology, such as TLS: While this technology achieves its goals on a technical level, attackers' strategies shift towards bypassing the security technology instead of breaking it. When users do not understand the security context in which they operate, then it becomes easy to deceive and defraud them. This Working Group is currently planning to see its main deliverable, the User Interface Guidelines, through to Recommendation, but will not engage in additional recommenation track work beyond this deliverable. The Working Group is currently operating at reduced Team effort (compared to the initial effort reserved to this Working Group). Initial (and informal) conversations are under way about forming an Interest Group that would provide a forum for the group's participants, and could also serve as a point of contact for specification review.
The XML Security Working Group started up in summer 2008, and has decided to publish an interim set of 1.1 specifications as it works towards producing a more radical change to XML Signature. The XML Signature 1.1 and XML Encryption 1.1 specifications clarify and enhance the previous specifications without introducing breaking changes, although they do introduce new algorithms. The recent published set of documents also include Algorithm Cross-Reference, Properties and Best Practices documents to enable adoption, Derived Keys to recognize a needed use case, and Use Cases and Transform Simplification documents to obtain early feedback to guide the development of 2.0. specifications.
The Web Security Context Working Group published a second Last Call Working Draft of its User Interface Guidelines document. Based on feed-back both in last-call comments and from implementers, the specification was cut down to specify best current practice in the space, as it has evolved over the last few years. Most experimental features have been dropped from this specification. By the time of the Advisory Committee Meeting, this last call will have concluded.
The XML Security Working Group published seven First Public Working Drafts on 26 February 2009, and solicits early community feed-back:
In December 2008, the W3C Workshop on Security for Access to Device APIs from the Web -- organized in conjunction with the Mobile Web Initiative -- assembled implementers, specification writers and researchers to discuss the security implications of powerful APIs that become accessible to Web technologies. The Workshop report identifies concrete APIs and the definition of an exchange format for relevant security policies as high-priority work items that enjoy sufficient critical mass in the community. The Team has begun initial, informal conversations on scoping this kind of work.
We hope to see the Web Security Context: User Interface Guidelines specification move ahead further on the Recommendation Track. Also, as sketched above, a revised activity structure is likely to emerge later this year. In this context, the Team welcomes member input into work items that merit particular attention.
| Group | Chair | Team Contact | Charter |
|---|---|---|---|
| Web Security Context Working Group (participants) | Mary Ellen Zurko | Thomas Roessler | Chartered until 31 December 2009 |
| XML Security Working Group (participants) | Frederick Hirsch | Thomas Roessler | Chartered until 31 May 2010 |
This Activity Statement was prepared for the October 2008 W3C Advisory Committee Meeting (Members only) per section 5 of the W3C Process Document. Generated from group data.
Thomas Roessler, Security Activity Lead
$Id: Activity.html,v 1.64 2009/06/04 14:41:31 sysbot Exp $