Intent to Ship: Contacts API

153 views
Skip to first unread message

Rayan Kanso

unread,
Nov 13, 2019, 11:11:47 AM11/13/19
to blink-dev

Contact emails

fin...@chromium.org, natt...@chromium.org, pe...@chromium.org, raya...@chromium.org


Explainer

https://github.com/wicg/contact-api/


Spec

https://wicg.github.io/contact-api/spec/


Tag Review: https://github.com/w3ctag/design-reviews/issues/337

 

Summary

Allows websites to request the names, e-mail addresses, and/or phone numbers of the contacts available on the user's device. Doing so requires a user gesture, upon which the user must explicitly select information about which contacts are to be shared.

 

This data is not shared directly. Instead, a contact picker will be shown to the user where they have to select which, if any, data to share with the website. The picker is attributed to the origin, and we visually indicate the data that is to be shared. This flow must be repeated each time the website wants access to contact information: no persistent access is granted.

 

This launch will not include a “Select All” button in the picker due to privacy abuse concerns around the feature. This might be re-examined in the future depending on how our metrics show users interacting with the picker, but that is unrelated to this launch.

 

The Origin Trial feedback was positive, with lots of the signed up parties emphasizing the ease of using/integrating with this API, and how they’d like to continue using it in the future.


Link to “Intent to Implement” blink-dev discussion

https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/GBgoS_eCmzM/


Is this feature supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

No. The feature and solution are platform agnostic, but we only provide an implementation for Android for now, where the problem is significantly more severe than on other platforms. Additional feedback is necessary to understand what the right solution is for the other platforms (e.g. Chrome OS), given that there may not always be a device-canonical contact source available.


Demo link

https://tests.peter.sh/contact-api


Risks

Interoperability and Compatibility


Edge: Positive

Firefox: No resolved position, but positive signals

Safari: No Signals

Web / Framework developers: Positive based on OT feedback


Ergonomics

No adverse effects on Chrome performance are expected. There are plans to start an M80 origin trial simultaneously with the launch to allow developers to request addresses & icons.


Activation

The API can be used immediately when shipped.


Is this feature fully tested by web-platform-tests? Link to test suite results from wpt.fyi.

Yes, link here.


Entry on the feature dashboard

https://www.chromestatus.com/feature/6511327140904960


Yoav Weiss

unread,
Nov 13, 2019, 5:20:27 PM11/13/19
to Rayan Kanso, blink-dev
On Wed, Nov 13, 2019 at 8:11 AM Rayan Kanso <raya...@chromium.org> wrote:

Contact emails

fin...@chromium.org, natt...@chromium.org, pe...@chromium.org, raya...@chromium.org


Explainer

https://github.com/wicg/contact-api/


Spec

https://wicg.github.io/contact-api/spec/


Tag Review: https://github.com/w3ctag/design-reviews/issues/337

 

Summary

Allows websites to request the names, e-mail addresses, and/or phone numbers of the contacts available on the user's device. Doing so requires a user gesture, upon which the user must explicitly select information about which contacts are to be shared.

 

This data is not shared directly. Instead, a contact picker will be shown to the user where they have to select which, if any, data to share with the website. The picker is attributed to the origin, and we visually indicate the data that is to be shared. This flow must be repeated each time the website wants access to contact information: no persistent access is granted.

 

This launch will not include a “Select All” button in the picker due to privacy abuse concerns around the feature. This might be re-examined in the future depending on how our metrics show users interacting with the picker, but that is unrelated to this launch.

 

The Origin Trial feedback was positive, with lots of the signed up parties emphasizing the ease of using/integrating with this API, and how they’d like to continue using it in the future.


Link to “Intent to Implement” blink-dev discussion

https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/GBgoS_eCmzM/


Is this feature supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

No. The feature and solution are platform agnostic, but we only provide an implementation for Android for now, where the problem is significantly more severe than on other platforms. Additional feedback is necessary to understand what the right solution is for the other platforms (e.g. Chrome OS), given that there may not always be a device-canonical contact source available.


Demo link

https://tests.peter.sh/contact-api


Risks

Interoperability and Compatibility


Edge: Positive

Firefox: No resolved position, but positive signals

Safari: No Signals


Have you reached out?
 

Web / Framework developers: Positive based on OT feedback


Ergonomics

No adverse effects on Chrome performance are expected. There are plans to start an M80 origin trial simultaneously with the launch to allow developers to request addresses & icons.


Activation

The API can be used immediately when shipped.


Is this feature fully tested by web-platform-tests? Link to test suite results from wpt.fyi.

Yes, link here.


Entry on the feature dashboard

https://www.chromestatus.com/feature/6511327140904960


--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAAe2mZ2KBAGy6DxmSYWtDoP7OqEATC1qa-dfg2a%2B0ZCwDaeJEQ%40mail.gmail.com.

Rayan Kanso

unread,
Nov 13, 2019, 6:07:06 PM11/13/19
to Yoav Weiss, blink-dev

Have you reached out?

There's an open WebKit bug for this (link). 

Yoav Weiss

unread,
Nov 15, 2019, 11:03:11 PM11/15/19
to Rayan Kanso, blink-dev
One more question: has this gone through security and privacy review?

On Wed, Nov 13, 2019 at 8:11 AM Rayan Kanso <raya...@chromium.org> wrote:

Rayan Kanso

unread,
Nov 18, 2019, 9:00:38 AM11/18/19
to Yoav Weiss, blink-dev
The Origin Trial went through privacy/security review, and this is shipping the same API. It's going through another round now, but it will be the same.

Chris Harrelson

unread,
Nov 21, 2019, 3:18:32 PM11/21/19
to Rayan Kanso, Yoav Weiss, blink-dev

Yoav Weiss

unread,
Nov 28, 2019, 9:07:50 AM11/28/19
to Chris Harrelson, Rayan Kanso, blink-dev
LGTM2

Mike West

unread,
Dec 5, 2019, 5:05:32 AM12/5/19
to Yoav Weiss, Chris Harrelson, Rayan Kanso, blink-dev
LGTM3. 

To answer Yoav's question with a little more detail, the privacy and security teams were quite interested in this API, and spent a good amount of time with the developers to understand the use cases, and ensure that the right mitigations are in place to ensure that user expectations are met, and that we're not causing unfortunate surprises. A particular sticking point has been the set of use cases around sharing multiple (all!) contacts with a given service. We came to an amicable compromise with this launch by dropping the "select all" mechanism from the original UI, and ensuring that we're doing a reasonable job of showing users the data they're explicitly choosing to share with the given site. That still addresses some important use cases, while introducing sufficient friction to (unexpectedly) dumping one's entire contact list.

-mike


Reply all
Reply to author
Forward
0 new messages