 |
Newsgroups: mozilla.dev.webapps
From: Lucas Adamski <ladam...@mozilla.com>
Date: Fri, 6 Jul 2012 01:31:43 +0200
Local: Thurs, Jul 5 2012 7:31 pm
Subject: Re: Adding Privacy to WebApps Permissions Security Model
On Jun 27, 2012, at 12:09 AM, Adrienne Porter Felt wrote:
> As it stands, users can only find out what applications do with their data
No argument there!
> if they go read a long privacy policy. Consequently, users likely assume > that their data is only being used for the functionality that they see. > For example, consider a game that asks for contacts in the context of > finding friends who also use the same game. Without reading the long > privacy policy, the user has little way of knowing that this app will now > *also* add those contacts' e-mail addresses to their mailing list. > Now imagine that developers had to specify the rationale for their actions
I'm more concerned with overtly malicious apps. The sanctions you mention above don't seem to have significantly dissuaded overtly bad actors from distributing malicious apps on Android devices. If they get a few thousand victims before they get pulled, they are still happy. Having apparently trustworthy UI that something like "this app would like to have your location/picture for the purposes of verifying your Bank of Whatever account information" seems like a serious issue to me. We have always treated security bugs in our chrome UI which let a 3rd party confuse or deceive the user as significantly worse & very different than simply the ability to display deceptive content.
> as part of the request. To continue my earlier example, the user would > immediately know that the data would be used for both friend-finding and > spam. Most developers are incentivized to be honest: if they are caught > lying, they'll face civil suits, removal from "official" markets, bad > press, and a decline in popularity. > The odds of encountering outright malware are fairly small, but users
Keep in mind that web installed apps (aka untrusted) don't have to be distributed by any app store, so blocking them is tricky. The ability to blacklist + review process are the two reasons I'm pretty happy to display "intended usage" for trusted apps.
> Here are some examples from the WWDC iOS 6 demo: http://twitpic.com/9yo9n4.
> On Tue, Jun 26, 2012 at 6:45 PM, Lucas Adamski <ladam...@mozilla.com> wrote:
>> On May 24, 2012, at 7:56 PM, Adrienne Porter Felt wrote:
>> Sure, but I'm more comfortable if users get phished the old fashioned way;
>> I'm not sure if your example would be accurately interpreted by most
> _______________________________________________
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
| |||||||||||||