friction and frequency minimization

[npdoty]

In order to keep the use of the API for high assurance credential presentation to infrequent, high assurance, necessary operations, friction and other frequency minimization features are necessary.

We don't have as much experience with standardizing for this since platform design has often been focused on seamless easy-to-use functionality. But some browsers have experimented with pauses when installing high-risk software, or use frequency to detect potential abuse of permission requests.

https://github.com/w3c/credential-considerations/blob/main/credentials-considerations.md#friction--frequency-minimization

[simoneonofri]

We have something similar in Vibration API

The user agent SHOULD employ global rate limiting to restrict the number of vibration requests made within a certain period (e.g., per minute or hour) to prevent excessive use.

From the review

Limit API Usage

Global: A global rate limit should be implemented to restrict the number of vibration requests made within a certain period (e.g., per minute or hour), preventing excessive use.

Session-Based: To prevent prolonged abuse, set session-based limits on the total vibration duration or number of vibrations that can occur during a single-user session.

Site-based: per site and subdomains

[johannhof]

So, I agree that:

• User agents should employ abuse detection in their prompting and, as part of that, prevent highly frequent requests from the same site.
• User agents can encourage users to make more well-considered decisions by introducing artificial delays to confirmation buttons.

But I don't believe that this is something that a spec could normatively enforce. But we can improve our permissions section of the privacy considerations with this suggestion.