{"action":"closed","issue":{"url":"https://api.github.com/repos/w3c/encrypted-media/issues/315","repository_url":"https://api.github.com/repos/w3c/encrypted-media","labels_url":"https://api.github.com/repos/w3c/encrypted-media/issues/315/labels{/name}","comments_url":"https://api.github.com/repos/w3c/encrypted-media/issues/315/comments","events_url":"https://api.github.com/repos/w3c/encrypted-media/issues/315/events","html_url":"https://github.com/w3c/encrypted-media/issues/315","id":175632881,"number":315,"title":"\"Provide per-origin user alerts / prompts and permissions\" headings do not accurately reflect the content","user":{"login":"ddorwin","id":9738764,"avatar_url":"https://avatars.githubusercontent.com/u/9738764?v=3","gravatar_id":"","url":"https://api.github.com/users/ddorwin","html_url":"https://github.com/ddorwin","followers_url":"https://api.github.com/users/ddorwin/followers","following_url":"https://api.github.com/users/ddorwin/following{/other_user}","gists_url":"https://api.github.com/users/ddorwin/gists{/gist_id}","starred_url":"https://api.github.com/users/ddorwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddorwin/subscriptions","organizations_url":"https://api.github.com/users/ddorwin/orgs","repos_url":"https://api.github.com/users/ddorwin/repos","events_url":"https://api.github.com/users/ddorwin/events{/privacy}","received_events_url":"https://api.github.com/users/ddorwin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"ddorwin","id":9738764,"avatar_url":"https://avatars.githubusercontent.com/u/9738764?v=3","gravatar_id":"","url":"https://api.github.com/users/ddorwin","html_url":"https://github.com/ddorwin","followers_url":"https://api.github.com/users/ddorwin/followers","following_url":"https://api.github.com/users/ddorwin/following{/other_user}","gists_url":"https://api.github.com/users/ddorwin/gists{/gist_id}","starred_url":"https://api.github.com/users/ddorwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddorwin/subscriptions","organizations_url":"https://api.github.com/users/ddorwin/orgs","repos_url":"https://api.github.com/users/ddorwin/repos","events_url":"https://api.github.com/users/ddorwin/events{/privacy}","received_events_url":"https://api.github.com/users/ddorwin/received_events","type":"User","site_admin":false},"assignees":[{"login":"ddorwin","id":9738764,"avatar_url":"https://avatars.githubusercontent.com/u/9738764?v=3","gravatar_id":"","url":"https://api.github.com/users/ddorwin","html_url":"https://github.com/ddorwin","followers_url":"https://api.github.com/users/ddorwin/followers","following_url":"https://api.github.com/users/ddorwin/following{/other_user}","gists_url":"https://api.github.com/users/ddorwin/gists{/gist_id}","starred_url":"https://api.github.com/users/ddorwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddorwin/subscriptions","organizations_url":"https://api.github.com/users/ddorwin/orgs","repos_url":"https://api.github.com/users/ddorwin/repos","events_url":"https://api.github.com/users/ddorwin/events{/privacy}","received_events_url":"https://api.github.com/users/ddorwin/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/w3c/encrypted-media/milestones/4","html_url":"https://github.com/w3c/encrypted-media/milestones/V1Editorial","labels_url":"https://api.github.com/repos/w3c/encrypted-media/milestones/4/labels","id":1765807,"number":4,"title":"V1Editorial","description":"Those issues are purely editorial.","creator":{"login":"mwatson2","id":7593867,"avatar_url":"https://avatars.githubusercontent.com/u/7593867?v=3","gravatar_id":"","url":"https://api.github.com/users/mwatson2","html_url":"https://github.com/mwatson2","followers_url":"https://api.github.com/users/mwatson2/followers","following_url":"https://api.github.com/users/mwatson2/following{/other_user}","gists_url":"https://api.github.com/users/mwatson2/gists{/gist_id}","starred_url":"https://api.github.com/users/mwatson2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mwatson2/subscriptions","organizations_url":"https://api.github.com/users/mwatson2/orgs","repos_url":"https://api.github.com/users/mwatson2/repos","events_url":"https://api.github.com/users/mwatson2/events{/privacy}","received_events_url":"https://api.github.com/users/mwatson2/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":49,"state":"open","created_at":"2016-05-14T00:27:23Z","updated_at":"2016-09-09T18:43:39Z","due_on":"2016-08-01T04:00:00Z","closed_at":null},"comments":4,"created_at":"2016-09-07T23:46:13Z","updated_at":"2016-09-09T18:43:39Z","closed_at":"2016-09-09T18:43:39Z","body":"Both the Security and Privacy sections have mitigations with the heading \"**Provide per-origin user alerts / prompts and permissions**\".\r\n\r\nThe current heading could be interpreted as:\r\n 1. The mitigation is to provide alerts or permission prompts.\r\n 1. The mitigation is to ensure that any alerts, prompts, or permissions are per-origin.\r\n\r\nMore importantly, both contain important requirements that extend beyond alerts, prompts, or permissions. The per origin (and per browsing profile) requirements in the following paragraph are an additional mitigation. Certainly those requirements must (#314) be per-origin, but that is not the most important mitigation in these sections.\r\n\r\nSpecifically:\r\n* https://w3c.github.io/encrypted-media/#security-prompts says, \"User agents SHOULD ensure that users are fully informed and/or give explicit consent before a Key System that presents security concerns that are greater than other user agent features (e.g. DOM content) may be accessed by an origin.\"\r\n* https://w3c.github.io/encrypted-media/#privacy-prompts says \"User agents MUST ensure that users are fully informed and/or give explicit consent before using Distinctive Identifier(s) and Distinctive Permanent Identifier(s).\"\r\n"}}
{"actor":{"display_login":"ddorwin"}}