Security Considerations: Writing Introduction

[simoneonofri]

Following @johannhof's excellent introduction to privacy, here is the section on security considerations, with various points raised by @Sh-Amir and @ZAnsaroudi.

In particular:

• Use scenarios
• External Dependencies
• Assumptions

Lists of the threats, in progress

[timcappalli]

@simoneonofri this is marked as both draft and awaiting review. Should we start reviewing?

[marcoscaceres]

I'm not loving any of this, TBH, as it doesn't provide any actual considerations.

The only part I would keep is the "this is part of a larger ecosystem".

We should list the actual considerations we have takes or are adding as we go... like, only available in secure contexts, not available to third-party iframes without a permission policy, the structures must be JSON serializable, calling the methods requires transient activation, etc.

[simoneonofri]

@marcoscaceres, thanks for the feedback. This is just the introduction section. Threats/mitigations are arriving.

We considered putting everything in one PR, but we thought doing smaller, more focused PRs would be more practical. Please let me know if you think there are more practical ways to talk about it.

[marcoscaceres]

We considered putting everything in one PR, but we thought doing smaller, more focused PRs would be more practical. Please let me know if you think there are more practical ways to talk about it.

Yes please. I think this was a good start, but it showed that the approach was overly broad.

Let's please do focused PRs instead.

[marcoscaceres]

@simoneonofri ok to close this?