Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Privacy policy and terms of service
2 views
Skip to first unread message
Kamal Marhubi
May 20, 2013, 9:29:57 AM5/20/13
to dev-id...@lists.mozilla.org
Hi,
I just took a look at these and I wanted to point out a couple of issues
I noticed, given in document order:
On the terms of service (https://login.persona.org/tos):
1. The overview uses male-gendered pronouns—‘The Persona service allows
a logged-in user to verify that *he* is the owner of a certain email
address [...] request that Mozilla confirm that the user has verified
the email address exists and is owned by *him*.’
It may be possible to reword to avoid them altogether. If not, I'm not a
gender theory expert but my preference would be to use the fairly
well-accepted singular they—‘The Persona service allows a logged-in user
to verify that *they are* the owner of a certain email address [...]
request that Mozilla confirm that the user has verified the email
address exists and is owned by *them*.’
2. Do the terms preclude for-pay email providers from being IdPs without
Mozilla's written permission? Under the heading ‘Use of the Services as
a Requesting Website or Email Provider’, it is stated that ‘You agree
not to: [...] trade or resell the Services for any purpose, unless you
have been specifically permitted to do so in writing by Mozilla’
3. I know it's non-exhaustive (‘such as’) but perhaps include mailing
lists here: ‘If we discontinue or change the Services, we will announce
it through Mozilla’s usual channels for such announcements such as blog
posts and forums.’ This text also appears undr the ‘Updates to terms’
heading. Both the methods of learning of changes are pull methods
requiring users to poll for changes, and it would be better to have a
publicised push method such as the persona-notices list.
--------
On the privacy policy (https://login.persona.org/privacy):
‘Your password is transferred to Mozilla using SSL encryption but is only retained by Mozilla's servers in an encrypted format (which means that it is not practically feasible to recover the password from this format).’ I assume what is meant here is that the stored password is hashed; I feel for a service like Persona you don't want your privacy policy conflating encryption and hashing in a single sentence.
-Kamal
I just took a look at these and I wanted to point out a couple of issues
I noticed, given in document order:
On the terms of service (https://login.persona.org/tos):
1. The overview uses male-gendered pronouns—‘The Persona service allows
a logged-in user to verify that *he* is the owner of a certain email
address [...] request that Mozilla confirm that the user has verified
the email address exists and is owned by *him*.’
It may be possible to reword to avoid them altogether. If not, I'm not a
gender theory expert but my preference would be to use the fairly
well-accepted singular they—‘The Persona service allows a logged-in user
to verify that *they are* the owner of a certain email address [...]
request that Mozilla confirm that the user has verified the email
address exists and is owned by *them*.’
2. Do the terms preclude for-pay email providers from being IdPs without
Mozilla's written permission? Under the heading ‘Use of the Services as
a Requesting Website or Email Provider’, it is stated that ‘You agree
not to: [...] trade or resell the Services for any purpose, unless you
have been specifically permitted to do so in writing by Mozilla’
3. I know it's non-exhaustive (‘such as’) but perhaps include mailing
lists here: ‘If we discontinue or change the Services, we will announce
it through Mozilla’s usual channels for such announcements such as blog
posts and forums.’ This text also appears undr the ‘Updates to terms’
heading. Both the methods of learning of changes are pull methods
requiring users to poll for changes, and it would be better to have a
publicised push method such as the persona-notices list.
--------
On the privacy policy (https://login.persona.org/privacy):
‘Your password is transferred to Mozilla using SSL encryption but is only retained by Mozilla's servers in an encrypted format (which means that it is not practically feasible to recover the password from this format).’ I assume what is meant here is that the stored password is hashed; I feel for a service like Persona you don't want your privacy policy conflating encryption and hashing in a single sentence.
-Kamal
0 new messages