20:11:09 <RRSAgent> RRSAgent has joined #privacy
20:11:09 <RRSAgent> logging to http://www.w3.org/2014/10/29-privacy-irc
20:11:11 <trackbot> RRSAgent, make logs 263
20:11:11 <Zakim> Zakim has joined #privacy
20:11:13 <trackbot> Zakim, this will be
20:11:13 <Zakim> I don't understand 'this will be', trackbot
20:11:14 <trackbot> Meeting: Privacy Interest Group Teleconference
20:11:14 <trackbot> Date: 29 October 2014
20:11:39 <wseltzer> s/Interest Group Teleconference/Breakout/
20:14:06 <BillHofmann> BillHofmann has joined #privacy
20:14:19 <bhill2> bhill2 has joined #privacy
20:15:04 <bhill2> scribenick: bhill2
20:16:00 <adrianba> adrianba has joined #privacy
20:17:53 <nvdbleek> nvdbleek has joined #privacy
20:18:03 <rigo> rigo has joined #privacy
20:18:17 <AxelPolleres> AxelPolleres has joined #privacy
20:18:32 <jeremie> jeremie has joined #privacy
20:19:14 <Ryladog> Ryladog has joined #privacy
20:19:53 <colin> colin has joined #privacy
20:20:11 <fabien-gandon> fabien-gandon has joined #privacy
20:20:18 <dbaron> dbaron has joined #privacy
20:20:20 <npdoty> npdoty has joined #privacy
20:20:21 <haakonfb> haakonfb has joined #privacy
20:20:23 <Engelke> Engelke has joined #privacy
20:21:26 <Bart_van_Leeuwen> Bart_van_Leeuwen has joined #privacy
20:21:26 <bhill2> bhill2 has joined #privacy
20:21:31 <bhill2> ... other areas of privacy that need focus
20:21:32 <laufer> laufer has joined #privacy
20:21:40 <bhill2> ... I worked on the data minimization draft on the TAG
20:21:51 <npdoty> npdoty has changed the topic to: Privacy and Openness breakout session
20:21:54 <bhill2> ... APIs should only expose required information to applications using them
20:22:05 <bhill2> ... e.g. geolocation only to the accuracy required (city vs. square meter)
20:22:37 <bhill2> ... earlier this year hosted STRING workshop joint w/ IETF + W3C about protecting web against pervasive monitoring
20:22:47 <bhill2> ... that's about bad government or other network actors
20:23:00 <bhill2> ... ignores whole other angle which is commercial privacy in context of tracking networks, how users use the web
20:23:03 <bhill2> ... this is a complex beast
20:23:26 <bhill2> ... in tag we are thinking about private browsing modes, have become a feature of all major browsers but work differently
20:23:40 <bhill2> ... not good user understanding of when what they do is private and when they should seek additional privacy
20:24:11 <bhill2> ... for what kinds of web usage they should think about privacy
20:24:54 <bhill2> ... e.g. researching medial information, political topics, - might want to use private browsing or TOR
20:24:54 <bhill2> ... also need to understand what privacy they are giving up when they use the web in general and what the transaction is
20:24:55 <npdoty> rrsagent, pointer?
20:24:55 <RRSAgent> See http://www.w3.org/2014/10/29-privacy-irc#T20-24-55
20:25:05 <bhill2> ... search for a washing machine, they will follow you around the web for a week
20:25:20 <npdoty> rrsagent, make logs public
20:25:22 <bhill2> ... working on both education and outreach and what we can socialize with the browser community
20:25:40 <wseltzer> s/STRING/STRINT/g
20:26:24 <JacquesD> JacquesD has joined #privacy
20:27:21 <npdoty> http://www.w3.org/Privacy/ <- Privacy Interest Group (PING) home page
20:28:08 <nvdbleek3> nvdbleek3 has joined #privacy
20:28:09 <npdoty> runnegar: talk about the Privacy Interest Group and what we are doing
20:28:16 <npdoty> ... develop guidance for web spec authors
20:28:21 <jmr> jmr has joined #privacy
20:28:39 <npdoty> ... 1) what are the known privacy vulnerabilities and risks associated with web standards?
20:28:43 <npdoty> ... 2) what privacy design principles make sense for the Web?
20:28:55 <npdoty> ... 3) how do we make sure privacy concerns are raised early?
20:29:14 <npdoty> ... 4) how should privacy reviews be conducted?
20:29:32 <npdoty> ... 5) how should conflicts between privacy and functionality be resolved?
20:29:42 <npdoty> runnegar: what's the problem space / threat model?
20:29:42 <jmr> jmr has joined #privacy
20:29:51 <npdoty> ... and process: how do we do this in the W3C community?
20:29:56 <olivier> olivier has joined #privacy
20:30:12 <npdoty> tara: maybe you've done reviews, or solicited reviews, or would like to get privacy reviews
20:30:32 <npdoty> ... how do you think we could be of benefit to that community?
20:30:32 <npdoty> ... suggestions welcome both now and later
20:31:17 <npdoty> katiehs: Process document is being re-written. should immediately have a privacy/security section, someone to contact to get that conversation started
20:31:18 <bhill2> ... one other thing - STRINT workshop was a call for additional encryption
20:31:18 <bhill2> ... more TLS is part of mitigation strategy
20:31:18 <bhill2> ... also about other features including HTTP/2, only implementing in secure mode
20:31:18 <bhill2> Christine and Tara
20:31:18 <bhill2> Christine Runegar
20:31:19 <bhill2> christine: there are two sessions combined here
20:31:19 <bhill2> ... rist - talk about PING and what we are doing
20:31:19 <bhill2> s/rist/first/
20:31:20 <bhill2> ... develop guidance for web spec authors on privacy
20:31:20 <bhill2> ... run through questions for discussions
20:31:21 <bhill2> ... 1st question: What are the known privacy vulnerabilities and risks associated with web standards?
20:31:21 <bhill2> ... 2nd: what are the relevant privacy questions for the web?
20:31:22 <bhill2> .2nd: what privacy design principles make sense for the web?
20:31:22 <bhill2> ... how do we make sure privacy concerns are raised early?
20:31:22 <bhill2> ... how should privacy reviews be conducted?
20:31:23 <bhill2> ... how will conflicts between privacy and functionality be resolved?
20:31:23 <bhill2> ... What is the threat model, what can we do about it at the spec layer, what is the process in W3C community?
20:31:24 <bhill2> Tara Whalen
20:31:24 <bhill2> ... how do you feel a group like PING could be of benefit?
20:31:24 <bhill2> Katie: process document is being rewritten, some mention in template of a security/privacy section
20:31:28 <bhill2> Katie Horito Shea (spelling?)
20:31:37 <adrianba> adrianba has joined #privacy
20:31:54 <wseltzer> s/Katie Horito Shea (spelling?)/Katie Haritos-Shea/
20:32:16 <bhill2> christine: documents we are working on: one is guidance on fingerprinting
20:32:28 <npdoty> privacy considerations section should be in the boilerplate?
20:32:29 <bhill2> ... second is general privacy guidance for web standards
20:32:40 <bhill2> ... third is guidance for how to conduct a privacy review
20:32:41 <npdoty> I think it's a cool idea, torgo
20:32:43 <ericstephan> ericstephan has joined #privacy
20:32:52 <npdoty> Specification Privacy Assessment
20:33:36 <npdoty> http://yrlesru.github.io/SPA/
20:34:28 <npdoty> TAG, Privacy Interest Group and Web Security Interest Group might all be doing similar types of reviews
20:35:00 <BillHofmann> BillHofmann has joined #privacy
20:36:28 <rigo> Dan, note that STRINT also callled for data minimization
20:36:55 <nvdbleek> nvdbleek has joined #privacy
20:37:25 <wseltzer> [some extra handles: affordances, defaults]
20:41:04 <npdoty> mnot: +1 wseltzer
20:41:04 <npdoty> mnot: privacy, more than many things, is complex and subtle
20:41:04 <npdoty> ... we need a mental model for users
20:41:04 <npdoty> ... communicate a complex thing to them in as a simple way as possible
20:41:04 <npdoty> q+ rigo
20:41:04 <npdoty> q+ npdoty
20:41:32 <npdoty> katie: we have an opportunity to create an international standard, as opposed to country-by-country regulation
20:41:38 <npdoty> ... would make everyone's life easier on the Web
20:42:29 <simonstey> simonstey has joined #privacy
20:43:13 <bhill2> bhill2 has joined #privacy
20:43:15 <bhill2> ... building those capabilities into specs is important.  don't let specs decide for users that a given level of privacy is not important
20:43:25 <bhill2> MarkNottingham: Wendy said it well, thank you.  Privacy is subtle and complex, need a mental model for users to understand.
20:43:26 <bhill2> ... be as simple but truthful as possible
20:43:26 <bhill2> Hadley: UX or education?
20:43:28 <bhill2> Mark: Both
20:43:29 <bhill2> Katie: being an intl stds org, we do have oppty, if ambitious to create an international standard
20:43:31 <bhill2> ... everyone had different rules and authorities, if there was a standard that makes sense
20:43:34 <bhill2> ... would make everyone's life on the web easier and better
20:43:37 <bhill2> ... world has a standard in accessiblity space that we have given them
20:43:38 <bhill2> ... that's the win we have there, much broader interest
20:43:39 <bhill2> ... seems to me companies are interested
20:43:41 <bhill2> hadley: yes,  much easier to make policy on something new
20:43:43 <bhill2> FredrickHirsch: get worried when we say we need to educate users
20:43:45 <bhill2> ... indicates a design or usability problem, can't boil the ocean
20:43:47 <wseltzer> ack rigo
20:43:48 <bhill2> Rigo: hint to Adrian Bateman : workshop on policy and user controls
20:43:49 <bhill2> ... have to be more intelligent on what we ask the user
20:43:50 <wseltzer> ack npdoty
20:43:51 <npdoty> ... the world has an Accessibility standard because of our work, that gets modified only slightly in different countries
20:43:51 <npdoty> ... a big win
20:43:51 <npdoty> hadley: easier to make policy based on existing practices rather than entirely new
20:43:51 <npdoty> fjh: I'm concerned about educating users, seems like a sign of a usability problem
20:43:52 <bhill2> ... deadline for position papers for this workshop is friday
20:43:54 <bhill2> NickDoty: push back on concept of balance
20:43:54 <npdoty> rigo: Workshop on User-Centric Controls is intended to address user interface
20:43:54 <npdoty> ... there is research present on user understanding and user experience
20:43:54 <npdoty> https://www.w3.org/2014/privacyws/
20:44:00 <bhill2> ... can be tempting to think we have to give up functionality to get privacy
20:44:26 <bhill2> ... in much larger number of cases you don't.  data minimization is good engineering practice for interop, future proofing, extensibility, performancenot just privacy
20:44:43 <bhill2> ... don't need to have privacy duke it out with other things
20:44:47 <dbaron> dbaron has joined #privacy
20:45:04 <bhill2> dan: I meant, e.g. if you turn on private browsing mode then you won't be able to have WebGL or XYZ technology
20:45:12 <bhill2> ... we already do have a push pull here
20:45:26 <bhill2> ... that's part of user education piece
20:45:47 <bhill2> ... when I explain to non-technical people about private browsing mode, they ask why its not always on?
20:46:06 <bhill2> ... functionality gets taken away when you turn that on
20:47:27 <bhill2> @@: private browsing mode is about tracks on client, not server, many do not understand that
20:47:33 <wseltzer> s/@@:/ddorwin:/
20:47:49 <bhill2> fjh: users are saying what they want - not another mode, just things to be private by default
20:47:55 <bhill2> Adrian Bateman: people want magic
20:48:10 <bhill2> ... nobody wants to make the investment in learning but the world is a complex place
20:48:16 <bhill2> ... shouldn't write off ability to educate people
20:48:26 <bhill2> ... is possible for people to learn but we need to think about how to simplify
20:48:43 <BillHofmann> BillHofmann has joined #privacy
20:48:53 <bhill2> ... how much of this should we be working on together, while also allowing different groups to compete on privacy
20:49:06 <bhill2> ... a more competitive landscape might drive innovation and incentivize improvements
20:49:18 <bhill2> hadley: we could also have governments impose this on technology being built
20:49:40 <bhill2> @@: fingerprinting: isn't a problem that we are behaviorial animals with routines
20:49:48 <bhill2> ... hard to be completely private
20:50:34 <bhill2> christine: not a magic bullet, but about fingerprinting, in an ideal world I could have the default vanilla browser fingerprint
20:50:34 <bhill2> ... lots of issues but its an idea
20:50:40 <bhill2> ... also hear "its too late" but nick has some ideas on how you could improve the situation
20:50:41 <nvdbleek> s/behaviorial/behavioral/
20:51:12 <bhill2> ... put aside user education, there are things the w3c community could do to improve user privacy when they use the web that they don't need to fully understand
20:51:12 <bhill2> ... data minimization is a classic example
20:51:16 <wseltzer> q+
20:51:19 <bhill2> katie: or tokenizing it
20:51:31 <bhill2> steven: one word: whisper
20:51:39 <fjh> fjh has joined #privacy
20:51:51 <bhill2> ... how would that have undone what whisper was doing?  selling itself as anonymous and then tracking users
20:52:06 <bhill2> christine: guardian was able to discover it and then there is possibility of enforcement
20:52:26 <bhill2> s/@@/Bart_van_Leeuwen/
20:52:49 <bhill2> steven: not sure how we can help when companies break their promises
20:52:49 <bhill2> hadley: certification?
20:52:54 <bhill2> steven: don't know, just panicing
20:53:14 <bhill2> wseltzer: some things w3c cannot address, some we have tools at hand
20:53:26 <bhill2> ... tools for spec authors
20:53:26 <bhill2> ... guidance to implementers on privacy considerations
20:53:42 <bhill2> ... web platform docs can give guidance to developers
20:53:51 <bhill2> ... can create background for regulators
20:54:24 <bhill2> ... e.g. to step in in cases of clear violation and abuse vs implementing a spec as written with no privacy guidance
20:54:33 <Steven> Steven has joined #privacy
20:54:59 <bhill2> @@: maybe we should not hope to avoid tracking but we should invest in making it possible to track being tracked
20:55:16 <bhill2> ... transparency, accountability are important
20:55:29 <bhill2> dan: mozilla tool?
20:55:37 <bhill2> room: "Collusion" was the name of the tool
20:55:59 <AxelPolleres> s/@@/AxelPolleres/
20:56:03 <Steven> Here are the slides from this morning's credentials for the web session - http://opencreds.org/presentations/2014/tpac-credentials/index.html#slide1
20:56:04 <bhill2> katie: even though it is an awesome idea, someone in security will work around
20:56:06 <bhill2> Q+
20:56:11 <wseltzer> q-
20:56:18 <wseltzer> q+ fjh
20:56:23 <wseltzer> q+ npdoty
20:56:24 <bhill2> fjh: important to ask the right questions
20:56:26 <wseltzer> q+ hadley
20:56:26 <bhill2> ack fjh
20:56:46 <bhill2> ... MIT has done work.. on this, accountability, consequences
20:57:00 <bhill2> q?
20:57:25 <wseltzer> bhill2: If we make privacy/security investmets that are trivial to work around, we haven't accomplished much
20:57:35 <wseltzer> ... make sure our investments are meaningful
20:58:00 <bhill2> bhill: we should invest in things that we can accomplish and make a difference
20:58:06 <wseltzer> ... rather than putting limited engergy of community into reducing the temperature of lava from 1m degrees by 10
20:58:13 <wseltzer> ack np
20:58:16 <wseltzer> ack bh
20:58:19 <engelke> engelke has joined #privacy
20:58:40 <bhill2> npdoty: fingerprinting, lots of research on detecting heuristics, we have a choice about what we put into http headers
20:58:43 <wseltzer> s/MIT has/Hal Abelson and DJW at MIT have/
20:58:47 <bhill2> ... vs putting things into javascript where it is easier to detect fingerprinting
20:58:56 <bhill2> ... just by being observable we can make progress
20:58:59 <bhill2> q?
20:59:04 <wseltzer> ack ha
20:59:18 <bhill2> ack hadley
20:59:24 <bhill2> hadley: we can easily be obsessive and build isolated boxes but that is not what users need and want
20:59:43 <bhill2> ... if it's not usable, users will go elsewhere where there are no protections
21:00:13 <bhill2> dan: if you ask users of nytimes about facebook integration, they might say yes... but you need tracking to have that
21:00:41 <bhill2> katie: we want to provide tools for devs, orgs and governments to make this happen, not be the police
21:00:53 <bhill2> hadley: for the record not the only member of UK government here
21:01:46 <bhill2> Charles_Engelke: wouldn't we need to go beyond the user agent to transports, etc. eg. ISP interference like Verizion
21:01:54 <bhill2> ... has been found to do
21:02:07 <wseltzer> [use Tor]
21:02:10 <bhill2> mnot: ISPs can do this even over HTTPS at TCP layer, etc
21:02:26 <bhill2> hadley: one purpose of govt is to protect people with little power from those with lots of power
21:02:42 <adrianba> adrianba has joined #privacy
21:02:51 <bhill2> ... e.g. with cookies, sites can be forced to interrupt users to inform them of use of cookies
21:03:03 <bhill2> ... govt could protect individuals from intermediaries
21:03:21 <bhill2> @@: Deutche Telecom has been doing lots of work and is privacy aware
21:03:33 <wseltzer> s/@@/Joerg_Heuer/
21:03:42 <bhill2> ... one thing that frightens us is not knowing if what we do is legal or not or will become illegal after we have built it
21:03:56 <bhill2> ... need tools to give services and users a way to communicate in a way which is almost guaranteed to be OK
21:04:08 <Steven> s/Deutche/Deutsche
21:04:11 <bhill2> ... rather than ex-post-facto discovering they are breaking the law
21:04:33 <bhill2> ... idea of a security tool that holds your identities, with a profile implementation bound to virtual cards
21:04:43 <JMR> JMR has joined #privacy
21:04:47 <bhill2> ... always convey my profile information with customer card and service could decide to never store it
21:04:57 <bhill2> ... so I could decentralize services, have data portability
21:05:09 <fjh_> fjh_ has joined #privacy
21:05:22 <bhill2> ... would be one tool, if acceptable, that would relieve companies of burden of holding profile data, data breaches, illegal processes
21:05:38 <bhill2> ... we can't avoid IP addresses, tracks from user agent
21:05:47 <fjh_> http://thenextweb.com/apps/2013/10/25/mozillas-lightbeam-firefox-add-lets-users-visualize-sites-tracking/
21:05:56 <fjh_> zakim, who is here?
21:05:56 <Zakim> sorry, fjh_, I don't know what conference this is
21:05:57 <Zakim> On IRC I see fjh_, JMR, adrianba, engelke, Steven, fjh, BillHofmann, dbaron, bhill2, nvdbleek, ericstephan, olivier, JacquesD, laufer, Bart_van_Leeuwen, fabien-gandon, colin,
21:05:57 <Zakim> ... jeremie, AxelPolleres, rigo, Zakim, RRSAgent, keiji, Ralph, TallTed, terri, wseltzer, trackbot
21:06:16 <bhill2> katie: the reason to start with principles is that's what all the laws are built off
21:06:26 <bhill2> ... so when you come up with something they can map to what you decide to do
21:06:48 <bhill2> ... want to add specific relevance to web content and environment, but legally speaking getting principles right is important
21:07:13 <bhill2> christine: remind everyone that Frederick and DAP did some trailblazing in this area for developing guidance in their space
21:07:34 <bhill2> ... we want to level that out to all w3c standards as much as possible and perhaps add new things
21:07:46 <hadleybeeman> hadleybeeman has joined #privacy
21:07:50 <bhill2> ... come to PINGs meeting on friday where we will work through these various design principles
21:08:11 <fjh> Is ‘lightbeam’ the Firefox extension Dan was thinking of? Builds graph of 3rd party connections from browsing
21:08:20 <bhill2> hadley: we are not only people who set standards for web, we are influential standards body among our peer orgs
21:08:51 <bhill2> dan: can we learn from history, web has become universal platform for banking and commerce, https got us here
21:08:53 <bhill2> ... design principle for https is getting people to spend money on the web according to PHB
21:09:07 <bhill2> ... now people are comfortable but also feel there is some level of security associated
21:09:26 <bhill2> ... certain websites people visit, e.g. when NHS put Facebook like buttons on their site, lots of outrage
21:09:38 <bhill2> ... didn't want facebook to know what they were viewing there
21:09:54 <bhill2> ... what can we learn from work web sites need to do, certification, regulation
21:10:06 <bhill2> ... this kind of website needs to implement these kinds of principles
21:10:33 <bhill2> hadley: useful on two levels - tangibly learn from the past, also really useful to use metaphors and previous stories to talk about things otherwise feel new and scary
21:10:46 <bhill2> ... explain to developers, policy makers, make it sound understandable and easier
21:11:00 <bhill2> fjh: wasn't just ssl that helped ecommerce, also regulation limiting liability
21:11:21 <bhill2> ... $50 limit to liability in US
21:11:46 <bhill2> rrsagent, make minutes
21:11:46 <RRSAgent> I have made the request to generate http://www.w3.org/2014/10/29-privacy-minutes.html bhill2
21:11:50 <bhill2> rrsagent, set logs public-visible
21:12:07 <wseltzer> wseltzer: huge thanks to bhill for scribing, even through network outages!
21:21:25 <nvdbleek> nvdbleek has joined #privacy
21:26:46 <AxelPolleres> AxelPolleres has joined #privacy
21:28:18 <Ralph> Ralph has left #privacy
21:35:23 <nvdbleek> nvdbleek has joined #privacy
21:45:34 <nvdbleek> nvdbleek has joined #privacy
21:49:46 <haakonfb> haakonfb has joined #privacy
21:56:34 <AxelPolleres> AxelPolleres has joined #privacy
21:57:58 <haakonfb> haakonfb has left #privacy
22:02:47 <fjh> fjh has joined #privacy
22:04:35 <AxelPolleres> AxelPolleres has joined #privacy
22:07:07 <AxelPolleres> AxelPolleres has joined #privacy
22:07:33 <AxelPolleres> AxelPolleres has left #privacy
22:09:34 <jeremie> jeremie has joined #privacy
22:13:48 <AxelPolleres> AxelPolleres has joined #privacy
22:23:22 <fjh> fjh has joined #privacy
22:24:53 <fjh_> fjh_ has joined #privacy
22:32:10 <AxelPolleres> AxelPolleres has joined #privacy
22:35:13 <fjh> fjh has joined #privacy
22:36:01 <nvdbleek> nvdbleek has joined #privacy
22:36:17 <AxelPolleres> AxelPolleres has joined #privacy
22:40:08 <AxelPolleres> AxelPolleres has joined #privacy
22:48:57 <fjh> fjh has joined #privacy
22:56:34 <fjh> fjh has joined #privacy
23:05:42 <fjh> fjh has joined #privacy
23:06:24 <fjh> fjh has joined #privacy
23:09:40 <fjh> fjh has joined #privacy
23:10:24 <fjh> fjh has joined #privacy
23:12:00 <AxelPolleres> AxelPolleres has joined #privacy
23:16:22 <AxelPolleres> AxelPolleres has left #privacy
23:17:02 <fjh> fjh has joined #privacy
23:20:45 <fjh> fjh has joined #privacy
23:22:07 <nvdbleek> nvdbleek has joined #privacy
23:22:41 <fjh> fjh has joined #privacy
23:55:21 <nvdbleek> nvdbleek has joined #privacy