Skip to content

Commit e818d0c

Browse files
github-actions[bot]RByers
github-actions[bot]
and
RByers
authored
chore: tidy up index.html (#192)
Co-authored-by: RByers <1280419+RByers@users.noreply.github.com>
1 parent 2d6ce1d commit e818d0c

File tree

1 file changed

+104
-100
lines changed

1 file changed

+104
-100
lines changed

‎index.html

Lines changed: 104 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -433,15 +433,15 @@ <h3>
433433
<h2>
434434
Security Considerations
435435
</h2>
436-
<div class="issue" title="Security Considerations section is a work in progress">
436+
<div class="issue" title=
437+
"Security Considerations section is a work in progress">
437438
<p>
438439
This section is a work in progress as this document evolves.
439440
</p>
440-
441441
<p>
442-
The documents listed below outline initial security considerations for
443-
Digital Credentials, both broadly and for presentation on the web.
444-
Their contents will be integrated into this document gradually.
442+
The documents listed below outline initial security considerations
443+
for Digital Credentials, both broadly and for presentation on the
444+
web. Their contents will be integrated into this document gradually.
445445
</p>
446446
<ul>
447447
<li>
@@ -450,91 +450,92 @@ <h2>
450450
TAG Security and Privacy Considerations Questionnaire (WIP)</a>
451451
</li>
452452
<li>
453-
<a href="https://github.com/w3c-cg/threat-modeling/blob/main/models/decentralized-identities.md">
453+
<a href=
454+
"https://github.com/w3c-cg/threat-modeling/blob/main/models/decentralized-identities.md">
454455
Threat Model for Decentralized Identities</a>
455456
</li>
456457
</ul>
457458
</div>
458-
459459
<section>
460-
<h3>Credential Protocols</h3>
461-
460+
<h3>
461+
Credential Protocols
462+
</h3>
462463
<p class="issue" title="Work in progress">
463-
Explain that while the API provides security at the browser API level, that
464-
security for the underlying credential issuance or presentation protocol is a
465-
separate concern and that developers need to understand that layer of the stack
466-
to get a total picture of the protections that are in place during any given
467-
transaction.
464+
Explain that while the API provides security at the browser API
465+
level, that security for the underlying credential issuance or
466+
presentation protocol is a separate concern and that developers need
467+
to understand that layer of the stack to get a total picture of the
468+
protections that are in place during any given transaction.
468469
</p>
469470
</section>
470-
471471
<section>
472-
<h3>Cross-device Protocols</h3>
473-
472+
<h3>
473+
Cross-device Protocols
474+
</h3>
474475
<p class="issue" title="Work in progress">
475-
Explain that cross-device issuance or presentation uses a separate protocol
476-
that has its own security characteristics.
476+
Explain that cross-device issuance or presentation uses a separate
477+
protocol that has its own security characteristics.
477478
</p>
478479
</section>
479-
480480
<section>
481-
<h3>Quishing</h3>
482-
481+
<h3>
482+
Quishing
483+
</h3>
483484
<p class="issue" title="Work in progress">
484-
Explain that the API is designed to avoid the problem of quishing
485-
(phishing via QR Codes) and other QR Code and non-browser API-based attacks
486-
and to be aware of exposure of QR Codes during digital credential interactions.
485+
Explain that the API is designed to avoid the problem of quishing
486+
(phishing via QR Codes) and other QR Code and non-browser API-based
487+
attacks and to be aware of exposure of QR Codes during digital
488+
credential interactions.
487489
</p>
488490
</section>
489-
490491
<section>
491-
<h3>Data Integrity</h3>
492-
492+
<h3>
493+
Data Integrity
494+
</h3>
493495
<p class="issue" title="Work in progress">
494-
Explain that the API does not provide data integrity on the digital
495-
credential requests or responses and that responsibility is up to the
496-
underlying protocol used for the request or response.
496+
Explain that the API does not provide data integrity on the digital
497+
credential requests or responses and that responsibility is up to the
498+
underlying protocol used for the request or response.
497499
</p>
498500
</section>
499-
500501
<section>
501-
<h3>Authentication</h3>
502-
502+
<h3>
503+
Authentication
504+
</h3>
503505
<p class="issue" title="Work in progress">
504-
Explain that authentication (such as a PIN code to unlock) to a particular app,
505-
such as a digital wallet, that responds to an API request is crucial in
506-
high-risk use cases.
506+
Explain that authentication (such as a PIN code to unlock) to a
507+
particular app, such as a digital wallet, that responds to an API
508+
request is crucial in high-risk use cases.
507509
</p>
508510
</section>
509-
510511
<section>
511-
<h3>Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)</h3>
512-
512+
<h3>
513+
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)
514+
</h3>
513515
<p class="issue" title="Work in progress">
514-
Explain what attacks are possible via XSS and CSRF, if any.
516+
Explain what attacks are possible via XSS and CSRF, if any.
515517
</p>
516518
</section>
517-
518519
<section>
519-
<h3>Session Security</h3>
520-
520+
<h3>
521+
Session Security
522+
</h3>
521523
<p class="issue" title="Work in progress">
522-
Explain that once a secure session is established at a website using
523-
credentials exchanged over this API, that the subsequent security is no
524-
longer a function of the credential used or this API and is up to the
525-
session management utilized on the website.
524+
Explain that once a secure session is established at a website using
525+
credentials exchanged over this API, that the subsequent security is
526+
no longer a function of the credential used or this API and is up to
527+
the session management utilized on the website.
526528
</p>
527529
</section>
528-
529530
</section>
530-
531531
<section class="informative">
532532
<h2>
533533
Privacy Considerations
534534
</h2>
535-
<div class="issue" title="Privacy Considerations section is a work in progress">
535+
<div class="issue" title=
536+
"Privacy Considerations section is a work in progress">
536537
<p>
537-
This section is a work in progress as this document evolves.
538+
This section is a work in progress as this document evolves.
538539
</p>
539540
<p>
540541
The documents listed below outline various privacy considerations for
@@ -555,90 +556,93 @@ <h2>
555556
for consideration in Internet and Web standardization
556557
</li>
557558
<li>
558-
<a href="https://github.com/w3c-cg/threat-modeling/blob/main/models/decentralized-identities.md">
559+
<a href=
560+
"https://github.com/w3c-cg/threat-modeling/blob/main/models/decentralized-identities.md">
559561
Threat Model for Decentralized Identities</a>
560562
</li>
561563
</ul>
562564
</div>
563-
564565
<section>
565-
<h3>Unnecessary Requests for Credentials</h3>
566-
566+
<h3>
567+
Unnecessary Requests for Credentials
568+
</h3>
567569
<p class="issue" title="Work in progress">
568-
Explain how the API could be used to unnecessarily request digital credentials
569-
from individuals such as requesting a driver's license to log into a
570-
movie rating website and how the ecosystem can mitigate this risk.
570+
Explain how the API could be used to unnecessarily request digital
571+
credentials from individuals such as requesting a driver's license to
572+
log into a movie rating website and how the ecosystem can mitigate
573+
this risk.
571574
</p>
572575
</section>
573-
574576
<section>
575-
<h3>Over Collection of Data</h3>
576-
577+
<h3>
578+
Over Collection of Data
579+
</h3>
577580
<p class="issue" title="Work in progress">
578-
Explain how the API could be used to request more data than necessary for
579-
a transaction and how the ecosystem can mitigate that over collection.
581+
Explain how the API could be used to request more data than necessary
582+
for a transaction and how the ecosystem can mitigate that over
583+
collection.
580584
</p>
581585
</section>
582-
583586
<section>
584-
<h3>Individual Consent</h3>
585-
587+
<h3>
588+
Individual Consent
589+
</h3>
586590
<p class="issue" title="Work in progress">
587-
Explain how the API acquires an individual's consent to share a digital
588-
credential and how digital wallets can also provide further consent when
589-
sharing information.
591+
Explain how the API acquires an individual's consent to share a
592+
digital credential and how digital wallets can also provide further
593+
consent when sharing information.
590594
</p>
591595
</section>
592-
593596
<section>
594-
<h3>Data Retention</h3>
595-
597+
<h3>
598+
Data Retention
599+
</h3>
596600
<p class="issue" title="Work in progress">
597-
Explain how verifiers might retain data and what the ecosystem does to
598-
mitigate excessive data retention policies.
601+
Explain how verifiers might retain data and what the ecosystem does
602+
to mitigate excessive data retention policies.
599603
</p>
600604
</section>
601-
602605
<section>
603-
<h3>Compliance with Privacy Regulations</h3>
604-
606+
<h3>
607+
Compliance with Privacy Regulations
608+
</h3>
605609
<p class="issue" title="Work in progress">
606-
Explain to what extent the API complies with known privacy regulations (e.g.,
607-
consent) and what parts of those regulations are not possible to enforce via the
608-
API (e.g., retention).
610+
Explain to what extent the API complies with known privacy
611+
regulations (e.g., consent) and what parts of those regulations are
612+
not possible to enforce via the API (e.g., retention).
609613
</p>
610614
</section>
611-
612615
<section>
613-
<h3>Selective and Unlinkable Disclosure</h3>
614-
616+
<h3>
617+
Selective and Unlinkable Disclosure
618+
</h3>
615619
<p class="issue" title="Work in progress">
616-
Explain how selective disclosure and unlinkable disclosure help preserve
617-
privacy as well as their limitations in doing so.
620+
Explain how selective disclosure and unlinkable disclosure help
621+
preserve privacy as well as their limitations in doing so.
618622
</p>
619623
</section>
620-
621624
<section>
622-
<h3>Phoning Home</h3>
623-
625+
<h3>
626+
Phoning Home
627+
</h3>
624628
<p class="issue" title="Work in progress">
625-
Explain how some systems might "phone home", the impact on privacy that
626-
might have, and what the ecosystem provides to mitigate the risk.
629+
Explain how some systems might "phone home", the impact on privacy
630+
that might have, and what the ecosystem provides to mitigate the
631+
risk.
627632
</p>
628633
</section>
629-
630634
<section>
631-
<h3>Transmission of Personally Identifiable Information</h3>
632-
635+
<h3>
636+
Transmission of Personally Identifiable Information
637+
</h3>
633638
<p class="issue" title="Work in progress">
634-
Explain that the API does enable the transmission of personally identifiable
635-
information and that it does its best to ensure there is informed consent
636-
by the individual, but that the consent might be provided due to exhaustion
637-
or not understanding what PII is being transmitted and how to mitigate those
638-
concerns.
639+
Explain that the API does enable the transmission of personally
640+
identifiable information and that it does its best to ensure there is
641+
informed consent by the individual, but that the consent might be
642+
provided due to exhaustion or not understanding what PII is being
643+
transmitted and how to mitigate those concerns.
639644
</p>
640645
</section>
641-
642646
</section>
643647
<section class="informative">
644648
<h2>

0 commit comments

Comments
 (0)