Re: [blink-dev] Intent to Prototype: Rewriter API

2024-09-12 Thread Tom Jones
yes there is a misunderstanding - i got the idea that the website's api could ask for the AI model it wanted - that would be a disaster. What does the website's API specifical have access to? I was about to ask the W3C security guy to take a look at this. Peace ..tom jones On Thu, Se

Re: [blink-dev] Intent to Prototype: Rewriter API

2024-09-11 Thread Tom Jones
they found one that would give access to my stuff. This is nuts. Please stop it now. Peace ..tom jones On Thu, Aug 22, 2024 at 5:05 PM Domenic Denicola wrote: > > > On Fri, Aug 23, 2024 at 2:45 AM Tom Jones > wrote: > >> It seems to me that the security and privacy r

Re: [blink-dev] Intent to Prototype: Rewriter API

2024-08-22 Thread Tom Jones
It seems to me that the security and privacy risks in this proposal are gigantic. Cross site scripting attacks have been difficult to block and now the suggestion is to allow some AI, which may change from day to day to insert attacks. Peace ..tom jones On Wed, Aug 21, 2024 at 11:28 PM Domenic

Re: [blink-dev] Intent to Prototype: Document-Isolation-Policy

2024-04-08 Thread Tom Jones
There is a huge demand for protecting data that's shared with users Any help in strong binding data to origin and blocking sharing would a big win. thx ..Tom (mobile) On Mon, Apr 8, 2024, 1:20 AM Yoav Weiss (@Shopify) wrote: > This is very interesting! > > Do I understand correctly and the mai

Re: [blink-dev] Re: Intent to Prototype: Web environment integrity API

2023-11-02 Thread Tom Jones
I appreciate the problems and am disappointed that the project was abandoned. I come from a different space, the Open Wallet Foundation, where a very similar problem is evolving (see the IETF RATS efforts as an example). In my view the problem is that the client should not need to trust the server

Re: [blink-dev] Intent to Experiment: Unrestricted access to performance.measureUserAgentSpecificMemory()

2023-10-13 Thread Tom Jones
I would add one other risk. Side channel attacks against security processes like encryption. ..tomj thx ..Tom (mobile) On Fri, Oct 13, 2023, 1:42 AM Michael Lippautz wrote: > Contact emails > > v...@chromium.org, mlippa...@chromium.org > > Explainer > > https://github.com/WICG/performance-mea

Re: [blink-dev] Intent to Ship: Enrollment for Privacy Sandbox

2023-09-08 Thread Tom Jones
ng toward showing information > directly to end-users, but that decision should be based on something > we expect the users to do with that information in real time, rather > than on transparency in the abstract. > > Jeffrey > > On Fri, Sep 8, 2023 at 12:28 PM Tom Jones > wrote:

Re: [blink-dev] Intent to Ship: Enrollment for Privacy Sandbox

2023-09-08 Thread Tom Jones
so explain to me how you can claim transparency? ..tom On Fri, Sep 8, 2023 at 12:26 PM Shivani Sharma wrote: > > > On Fri, Sep 8, 2023 at 2:51 PM Tom Jones > wrote: > >> This statement is under non goals. So I think you need to change that or >> remove the claim of

Re: [blink-dev] Intent to Ship: Enrollment for Privacy Sandbox

2023-09-08 Thread Tom Jones
This statement is under non goals. So I think you need to change that or remove the claim of transparency. thx ..Tom (mobile) On Fri, Sep 8, 2023, 11:06 AM Shivani Sharma wrote: > > > On Fri, Sep 8, 2023 at 12:55 PM Tom Jones > wrote: > >> I cannot understand how it

Re: [blink-dev] Intent to Ship: Enrollment for Privacy Sandbox

2023-09-08 Thread Tom Jones
I cannot understand how it is possible to claim transparency with the following explanation. It seems completely misleading. Today, the attestation model does not seek to provide information to users within the browser or device in real-time about a developer's attestations thx ..Tom (mobile) On

Re: [blink-dev] Re: Intent to Prototype: Web environment integrity API

2023-07-25 Thread Tom Jones
Perhaps it is a good thing for user choice to have a browser that is fully open to any use and allows anonymous user actions. The result of such open-ness is that an entire series of services that need to trust the client(used in the oauth sense of the word) are not available to web apps. Conside

Re: [blink-dev] Intent to Prototype: Web Smart Card API

2022-09-23 Thread Tom Jones
It is not possible to get onto DOD sites today without loading certs, so there are lots of hills to climb. I would like to start testing this asap - what do I need to do? ..tom On Fri, Sep 23, 2022 at 9:09 AM Christian Biesinger wrote: > While I don't know if this specific proposal would suppor