07:11:22 <RRSAgent> RRSAgent has joined #boundary-upgrade
07:11:22 <RRSAgent> logging to https://www.w3.org/2021/10/21-boundary-upgrade-irc
07:11:24 <dom> RRSAgent, stay
07:11:26 <dom> RRSAgent, make log public
12:11:46 <jeff> jeff has joined #boundary-upgrade
13:45:56 <johnwilander> johnwilander has joined #boundary-upgrade
13:48:16 <wseltzer> wseltzer has joined #boundary-upgrade
13:48:21 <Zakim> Zakim has joined #boundary-upgrade
13:48:40 <johnwilander> I don't see a link to a virtual video session. I'm logged in to web-eur.cvent.com and see the IRC link though.
13:49:32 <johnwilander> Got it. I now saw an email too since I registered for the session.
13:49:46 <wseltzer> they appear 5min before the meeting
13:59:00 <jrosewell> jrosewell has joined #boundary-upgrade
13:59:07 <jrosewell> present+
13:59:12 <russStringham> russStringham has joined #boundary-upgrade
14:00:57 <johnwilander> Wendy, did you say you'll stop recording once we go into the discussion?
14:01:00 <weiler> weiler has joined #boundary-upgrade
14:01:36 <bmay> bmay has joined #boundary-upgrade
14:01:42 <cwilso> cwilso has joined #boundary-upgrade
14:02:12 <cpn> cpn has joined #boundary-upgrade
14:02:29 <wseltzer> johnwilander, yes, we will announce when recording starts and stops
14:02:45 <cpn> present+ ChrisNeedham
14:02:54 <cwilso> present+
14:03:22 <KaustubhaGovind> KaustubhaGovind has joined #boundary-upgrade
14:03:35 <jyasskin> present+
14:03:41 <dmarti> dmarti has joined #boundary-upgrade
14:04:23 <jeff> present+
14:04:48 <eriktaubeneck> eriktaubeneck has joined #boundary-upgrade
14:05:10 <wseltzer> jrosewell: [presentation]
14:05:43 <wseltzer> Meeting: Upgrade Privacy Boundaries Defined Solely by Registerable Domains
14:10:10 <dom> dom has joined #boundary-upgrade
14:12:39 <eriktaubeneck_> eriktaubeneck_ has joined #boundary-upgrade
14:14:38 <jeff> q+ to ask for more clarity about the circular debate.  It was not clear to me what James meant.
14:15:32 <jyasskin> q+
14:17:44 <wseltzer> q?
14:17:52 <wseltzer> ack jeff
14:17:52 <Zakim> jeff, you wanted to ask for more clarity about the circular debate.  It was not clear to me what James meant.
14:18:04 <weiler> q+
14:18:22 <btsavage> btsavage has joined #boundary-upgrade
14:18:23 <harneet_sidhana> harneet_sidhana has joined #boundary-upgrade
14:18:27 <btsavage> q?
14:18:29 <seanbedford> seanbedford has joined #boundary-upgrade
14:18:34 <btsavage> q+
14:18:35 <wseltzer> jeff: Can you be more specific about what you mean by circular debate?
14:19:08 <wseltzer> jrosewell: discussion in other groups, PCG, IWAGB
14:19:19 <bmay> q+
14:19:31 <wseltzer> ... first party sets, debates around what criteria are needed for a set to be formed
14:19:46 <wseltzer> ... who makes the decision?
14:20:00 <sysrqb> sysrqb has joined #boundary-upgrade
14:20:02 <eriktaubeneck_> q+
14:20:20 <wseltzer> ... that takes us to discussions of sanctioned/unsanctioned, good or bad
14:20:46 <wseltzer> ... A poll in federated ID CG showed a  50-50 split on direction
14:21:02 <wseltzer> ... need to unblock debates
14:21:28 <hober> hober has joined #boundary-upgrade
14:21:33 <wseltzer> jeff: there are many topics where we don't yet have consensus, consensus is sometimes hard to reach
14:21:35 <hober> present+
14:21:40 <wseltzer> ack next
14:22:10 <jyasskin> https://github.com/sleevi/psl-problems
14:22:33 <wseltzer> jyasskin: Google has a history of both complaining about the registrable domain problem and proposing alternatives such as first-party sets
14:22:37 <BrianLefler> BrianLefler has joined #boundary-upgrade
14:22:52 <wseltzer> ... I came to this hoping for suggestions or discussions of whast to replace the bounary with
14:23:02 <wseltzer> ... don't think it's productive to say there should be no boundary
14:23:13 <wseltzer> ... but rather look for replacements
14:23:19 <wseltzer> ... what do people think alternatives should be?
14:24:04 <wseltzer> jrosewell: one idea in the navigation tracking mitigation repository,
14:24:13 <wseltzer> ... looks at how we can bring contracts into registrable domains
14:24:19 <jyasskin> I believe that's https://github.com/privacycg/nav-tracking-mitigations/issues/13.
14:24:26 <seanbedford> q+
14:24:58 <wseltzer> ... people can choose which standard contracts they can have their data shared under
14:25:07 <wseltzer> ... introduces transparency and audit
14:25:23 <wseltzer> ... explaining how people can see the parties involved in advertising and tracking
14:26:20 <jrosewell> q?
14:26:29 <wseltzer> jyasskin: thanks for focusing our attention on OWID as alternative
14:26:33 <wseltzer> ack weiler
14:26:42 <johnwilander> q+
14:26:53 <wseltzer> weiler: thinking about requirements
14:27:21 <wseltzer> ... you asked where's the authority: ultimately, I'd say, it lies with end-user
14:27:35 <wseltzer> ... and to be able to exercise, they need to be able to automate
14:28:11 <wseltzer> jrosewell: depends what you're sharing. Ordinarily we'd want things to be frictionless
14:28:20 <wseltzer> weiler: so why not have user define the policy?
14:29:04 <wseltzer> jrosewell: In discussions elsewhere, people have discussed trusting other organizations,
14:29:18 <wseltzer> ... e.g. the Scouts, to pick a set of settings
14:29:45 <wseltzer> ... standard contractual clauses, contracts a regulator has approved for data-sharing
14:30:13 <wseltzer> ... I have another session, through Movememt for Open Web, going into detail on a proposed solution
14:30:20 <jrosewell> q?
14:30:29 <wseltzer> ack btsavage
14:31:01 <wseltzer> btsavage: personal opinion, not speaking for Facebook
14:31:10 <wseltzer> ... I think it makes sense to have this conversation
14:31:40 <wseltzer> ... thinking from perspective of end-user and their expectations
14:32:11 <wseltzer> ... to the extent personal info is being exchanged between business in ways that would surprise user, that's problematic
14:32:40 <wseltzer> ... also, few users read privacy policies to understand what's going on
14:33:33 <wseltzer> ... so we shouldn't rely on privacy policies to set user expectations
14:34:00 <wseltzer> ... a metric to gauge proposals: to what extent would using $this as a privacy boundary meet user expecations
14:34:16 <wseltzer> ... domains are visually displayed, there's a decent amount of education
14:34:45 <wseltzer> ... research; also problems such as phishing and scam domains
14:35:15 <wseltzer> ... "would sharing data across this boundary surprise or upset people, would it misalign with expectations"
14:35:17 <jyasskin> +1 btsavage
14:35:31 <wseltzer> ... and don't expect we can modify those expecations with privacy policies
14:35:59 <wseltzer> jrosewell: think we can all agree that terms and conditions are not always read; that's an issue with contract law
14:36:55 <wseltzer> ... while some companies have tried to make those more engaging
14:37:17 <wseltzer> ... often, in other industries, you trust someone, an organization standing behind the contracts
14:37:57 <wseltzer> ... don't see how we can get away from legal contract defining service
14:38:14 <dmarti> q+
14:38:41 <wseltzer> btsavage: don't think we as engineers in W3C should be saying it's ok for us to accept surprising information flows, so long as a contract describes that
14:39:08 <weiler> +1 to btsavage re: not relying on contracts, for other reasons
14:39:12 <jrosewell> q?
14:39:17 <jyasskin> It's interesting that we have such a consensus among engineers here that terms and conditions are completely useless in getting any sort of real agreement from users, and yet we haven't been able to convince any of the legal system, whether inside or outside our companies, of that. I hope btsavage is right that the legal systems will eventually move in that direction.
14:39:20 <wseltzer> ... some contracts we've eliminated, such as overdraft fees
14:39:32 <wseltzer> bmay: with Dstillery, do audience targeting
14:40:02 <wseltzer> ... A domain means lots of different things
14:40:23 <wseltzer> ... compare "google" to "bobssportinggoods"
14:40:53 <wseltzer> ... the user is interacting with the organization/people behind the domain
14:41:01 <wseltzer> ... we'd do well to come up with a new identity primitive
14:41:14 <alextcone> alextcone has joined #boundary-upgrade
14:41:22 <wseltzer> ... privacy and identity semantics, as a basis for data-based interactions with individuals and organizations
14:41:26 <btsavage> People may not understand who they are interacting with when they use a website
14:41:53 <wseltzer> ... rules around how data can be used and transmitted, and means to discover how info has been used
14:42:04 <wseltzer> ... don't think domains are the answer
14:42:42 <wseltzer> ... similar to what weiler said, ask the browser to act on your behalf
14:43:10 <wseltzer> ... develop an auditing and reporting system that would allow user to understand how data is being used and remediate inappropriate uses
14:43:42 <jrosewell> q?
14:43:51 <wseltzer> ack bm
14:43:53 <wseltzer> ack eriktaubeneck_
14:44:34 <wseltzer> eriktaubeneck_: clarification, I wanted to understand what point you were making about Doritos.com and .co.uk having different privacy policies
14:44:50 <wseltzer> ... in different jurisdictions, they'd have different policies
14:45:52 <wseltzer> jrosewell: I was trying to say that because domains are simmilar, consumers might expect same activity, but it's the privacy policy more than ownership that matters
14:46:34 <wseltzer> eriktaubeneck_: I'd expect differences in different jurisdictions
14:47:07 <jrosewell> q?
14:47:18 <wseltzer> jrosewell: I was trying to show that ownership may not be only relevant factor
14:47:29 <wseltzer> seanbedford: also work for Facebook, expressing my personal opinion
14:47:44 <wseltzer> ... if we're going to draw a boundary, need to be very clear where it sits
14:47:51 <wseltzer> ... there's a legal definition
14:48:15 <wseltzer> ... in Papa John's example, a franchised business, each store is a different legal entity
14:48:44 <wseltzer> ... some connection to entity, user expectation. many facets we need to think about together
14:49:05 <wseltzer> ... eTLD+1 feels insufficient; hope we can come up with something better
14:49:13 <wseltzer> ... many different defitions
14:49:33 <wseltzer> ... user expectations; legal definitions of what a regulator would enforce
14:50:05 <wseltzer> ... other digital touchpoints I might have with those businesses, e.g. order through an app
14:50:16 <wseltzer> ... don't think we can come to a single answer focused only on web
14:50:34 <wseltzer> ... not sure what the better thing will be
14:50:48 <wseltzer> jrosewell: can we come to agreement by the end of this discussion?
14:50:52 <wseltzer> ack se
14:50:56 <jrosewell> q?
14:51:01 <bmay> q+
14:51:03 <wseltzer> ack johnwilander
14:51:07 <weiler> q+
14:51:20 <wseltzer> johnwilander: Apple webkit; wanted to mention some technical apsects
14:51:28 <wseltzer> ... cookiies can span origins (subdomains)
14:51:44 <wseltzer> ... if we didn't have cookies spanning origins, and document.domain, we'd just use origin
14:52:07 <wseltzer> ... there's been a proposal for HTTP state mechanism tied to origin rather than cookies, maybe we can move login there
14:52:20 <wseltzer> ... and then do isolation based on origin rather than registrable domain
14:52:42 <wseltzer> ... origin is combination of protocol, hostname, and port
14:52:49 <wseltzer> ... complete with subdomain
14:53:00 <wseltzer> ... that triple defines an origin
14:53:07 <wseltzer> ... most of the web security is tied to origin
14:53:07 <alextcone> <scheme>://[<hostname>.]<host>[:<port>]
14:53:37 <wseltzer> jrosewell: your preference would be origin?
14:53:52 <wseltzer> ... separate origins, with no data-sharing between subdomains
14:54:05 <jrosewell> q?
14:54:13 <wseltzer> johnwilander: yes, technical implemenation, with possible APIs for inter-origin communication
14:54:17 <wseltzer> ack dmarti
14:54:45 <wseltzer> dmarti: when one of the browsers made some changes to data-sharing, there was tremendous user resarech to back it up
14:55:04 <btsavage> +1
14:55:13 <btsavage> 100% dmarti
14:55:32 <wseltzer> ... setting sensible defaults is an argument for user research: mockups with which to ask users "what would expect to happen in this situation"
14:55:44 <wseltzer> ... hope we could do that in next ireation fo discussion
14:55:50 <wseltzer> ... I'm happy to share resource links
14:56:14 <btsavage> q+
14:56:15 <wseltzer> jrosewell: time for us to think about what happens next
14:56:19 <jrosewell> q?
14:56:22 <wseltzer> q+
14:56:32 <wseltzer> ack bm
14:57:11 <wseltzer> bmay: it's easy to identify domain as wrong primitive; would be intersting to figure what user relates to, and how we define rules for that
14:57:37 <wseltzer> weiler: I'm not inclined to rely on contracts, since internet and web cross international boundaries
14:57:59 <wseltzer> ... I'd rather see us work on technical measures
14:58:02 <wseltzer> ack bt
14:58:05 <wseltzer> ack we
14:58:57 <wseltzer> btsavage: sounded to me as though there was fair degree of consensus with idea that data sharing and privacy boundaries, what browser should do is what people woudl want if they took the time to undersatnd
14:59:23 <wseltzer> ... poll, do people believe privacy boundaries should match user expectations
14:59:26 <wseltzer> ack me
15:00:06 <BrianLefler> +1 user agent acting defensively on behalf of user's privacy is good (though that shoudl also be balanced against usability, privacy isn't the only user concern)
15:00:26 <wseltzer> wseltzer: any place to invite people to watch for next steps in this conversation?
15:01:08 <wseltzer> jrosewell: there are many groups in which it could fit. I'd like to ask that we make it into one conversation, perhaps in privacy cg
15:02:05 <wseltzer> rrsagent, draft minutes
15:02:05 <RRSAgent> I have made the request to generate https://www.w3.org/2021/10/21-boundary-upgrade-minutes.html wseltzer
15:02:08 <wseltzer> chair: jrosewell:
15:02:15 <wseltzer> rrsagent, make logs public
15:02:18 <wseltzer> rrsagent, draft minutes
15:02:19 <RRSAgent> I have made the request to generate https://www.w3.org/2021/10/21-boundary-upgrade-minutes.html wseltzer
15:59:26 <dom> RRSAgent, bye
15:59:26 <RRSAgent> I see no action items