Edit comment LC-2412 for Mobile Web Best Practices Working Group

Quick access to LC-2407 LC-2408 LC-2412 LC-2413 LC-2414 LC-2415 LC-2416

Comment LC-2412

Comment Shortname:

Commenter: David Campbell <dcampbell@owasp.org>

Message-id:

Section of the document concerned:

[Free text description]Document as a wholeMobile Web Application Best Practices Abstract Status of This Document Table of Contents Appendices List of Best Practices 1 Introduction 1.1 Purpose of the Document 1.2 Audience 1.3 Scope 1.3.1 Best Practices 1.3.2 Web Application 1.3.3 Mobile Context 1.3.4 Delivery Context 1.4 Relationship to other Best Practices and recommendations 1.5 Terminology 2 Structure of Best Practice Statements 3 Best Practice Statements 3.1 Application Data 3.1.1 Use Cookies Sparingly 3.1.1.1 What it means 3.1.2 Use Appropriate Client-Side Storage Technologies for Local Data 3.1.2.1 What it means 3.1.2.2 How to do it 3.1.3 Replicate Local Data To A Server If Necessary 3.1.3.1 What it means 3.1.3.2 How to do it 3.2 Security and privacy 3.2.1 Do not Execute Unescaped or Untrusted JSON data 3.3 User Awareness and Control 3.3.1 Ensure the User is Informed About Use of Personal and Device Information 3.3.1.1 What it means 3.3.1.2 How to do it 3.3.2 Enable Automatic Sign-in 3.3.2.1 What it means 3.3.2.2 How to do it 3.4 Conservative use of resources 3.4.1 Use Transfer Compression 3.4.1.1 What it means 3.4.1.2 How to do it 3.4.2 Minimize Application and Data Size 3.4.2.1 What it means 3.4.2.2 How to do it 3.4.3 Avoid Redirects 3.4.3.1 What it means 3.4.3.2 How to do it 3.4.4 Optimize Network Requests 3.4.4.1 What it means 3.4.4.2 How to do it 3.4.5 Minimize External Resources 3.4.6 Aggregate Static Images into a Single Composite Resource (Sprites) 3.4.7 Include Background Images Inline in CSS Style Sheets 3.4.8 Cache Resources By Fingerprinting Resource References 3.4.9 Cache AJAX Data 3.4.10 Do not Send Cookie Information Unnecessarily 3.4.11 Keep DOM Size Reasonable 3.4.11.1 What it means 3.4.11.2 How to do it 3.5 User Experience 3.5.1 Optimize For Application Start-up Time 3.5.1.1 What it means 3.5.1.2 How to do it 3.5.2 Minimize Perceived Latency 3.5.2.1 What it means 3.5.2.2 How to do it 3.5.3 Design for Multiple Interaction Methods 3.5.3.1 What it means 3.5.3.2 How to do it 3.5.4 Preserve Focus on Dynamic Page Updates 3.5.4.1 What it means 3.5.4.2 How to do it 3.5.5 Use Fragment IDs to Drive Application View 3.5.6 Make Telephone Numbers "Click-to-Call" 3.5.6.1 What it means 3.5.6.2 How to do it 3.5.7 Ensure Paragraph Text Flows 3.5.8 Ensure Consistency Of State Between Devices 3.5.9 Consider Mobile Specific Technologies for Initiating Web Applications 3.5.9.1 What it means 3.5.9.2 How to do it 3.5.10 Use Meta Viewport Element To Identify Desired Screen Size 3.5.10.1 What it means 3.5.10.2 How to do it 3.6 Handling Variation in the Delivery Context 3.6.1 Prefer Server-Side Detection Where Possible 3.6.1.1 What it means 3.6.1.2 How to do it 3.6.2 Use Client-Side Capability Detection Where Necessary 3.6.2.1 What it means 3.6.2.2 How to do it 3.6.3 Use Device Classification to Simplify Content Adaptation 3.6.3.1 What it means 3.6.3.2 How to do it 3.6.4 Support a non-JavaScript Variant if Appropriate 3.6.4.1 What it means 3.6.4.2 How to do it 3.6.5 Offer Users a Choice of Interfaces 3.6.5.1 What it means 3.6.5.2 How to do it 3.7 Further Considerations 3.7.1 Consider Use of Canvas Element or SVG For Dynamic Graphics 3.7.1.1 What it means 3.7.1.2 How to do it http://www.w3.org/Graphics/SVG/ 3.7.2 Inform the User About Automatic Network Access 3.7.2.1 What it means 3.7.2.2 How to do it 3.7.3 Provide Sufficient Means to Control Automatic Network Access 3.7.3.1 What it means 3.7.3.2 How to do it Appendix 1: Best Practice Dependent Device Properties Appendix 2: References 2.1 MWI References 2.2 Device Independence 2.3 Web, Protocols and Languages 2.4 Other References Appendix 3: Acknowledgments
or

Refinement of the section concerned:

Status:

open proposal pending resolved_yes resolved_no resolved_partial other assigned to Nobody

Type: substantive editorial typo question general comment undefined

Resolution status:

Response drafted Resolution implemented Reply sent to commenter

Response status:

No response from Commenter yet Commenter approved disposition Commenter objected to disposition
Commenter's response (URI):

Comment:

Dear Sir or Madam:

I represent the Global Industry Committee of the Open Web Application
Security Project (OWASP) and we are keenly interested in your
forthcoming Mobile Web Application Best Practices recommendation.

Attached please find a PDF document containing our comments on your
draft recommendation.

Please feel free to contact me directly with any questions, comments or
concerns.

Cheers,

David Campbell
Open Web Application Security Project
dcampbell@owasp.org
www.owasp.org

Related issues: (space separated ids)

WG Notes: Notes from fd (2010-08-24): The suggested security-related additions are relevant to Web applications in general but I fail to see any mobile specificity here, so I don't think we should include any of these proposals. What we should probably do is to emphasize in the intro text of 3.2 that security measures that are valid for Web applications are de facto valid for mobile Web applications, and that we're only pointing out a best practice that has some mobile-related aspect to it in that section. Discussion and resolution at: http://www.w3.org/2010/08/24-bpwg-minutes.html#lc2412 RESOLUTION: ref. LC-2412, mark as substantive and resolve partial, pointing out that we don't have the expertise to select best practices related to security in this working group and that we focused on the most obvious one that was more particularly relevant to mobile. Future version of best practices should probably include more detailed security related best practices. Update the intro text to emphasize that most "desktop" security measures are applicable to the "mobile" context and that the best practice listed in this section is called out because of its specific mobile twist. Add wording along the lines of "example of such regular security best practices may be found at" with a reference to OWASP.

Resolution: The group partially agrees with the comment. The Mobile Web Application Best Practices is explicitly scoped to best practices that have some specific impact on the mobile context: http://www.w3.org/TR/mwabp/#mobile-context The Working Group acknowledges that most "desktop" security-related best practices also apply to mobile devices and updated the introduction text of the "Security and Privacy" section to reflect that the one best practice listed in that section is definitely not the end of it. The Working Group has also decided to reference the OWASP TOP 10 work as example of usual security measures in this text. See updated text in latest editor's draft: http://www.w3.org/2005/MWI/BPWG/Group/Drafts/BestPractices-2.0/latest#bp-security The group does not feel it has the expertise to review and select other best practices related to security and decided against adding more best practices to the section. A future version of the best practices should probably include a more comprehensive set of best practices related to security. The best practice listed in this category was chosen on the grounds that it was the most obvious client-side security hole to bridge in a mobile Web application that might have access to personal information. In particular, a mobile Widget could perhaps be allowed to send SMS or make phone calls while the device is connected to an "untrusted" public Wifi connection, thus enabling potential man-in-the-middle attacks.

(Please make sure the resolution is adapted for public consumption)