agree a new permission model is needed and it applies for local/native and web. android when you download/install you give permissions right there, one, which is not painful. On the web w/ access to local (I’m talking about mobile here) security issues will exist, but we should ask the user *once*.

…and I really like the idea of having like a grand view “monitor” of some kind that gives you visual hints on what apps are doing…

ceo

Totally agree. Excited to see how things progress.

Cheers,

Dion

I think this point is extremely important. I know it’s perhaps orthogonal to your core idea, but the question should be user meaningful, and in the case of multiple questions we should visually prioritize based on user risk, to the extent that we can determine relative risks. Lots of hard work left here to do to generate a simple, uncluttered, straightforward question.

And as you implied the question is the fallback.. “implicit interfaces” which provide implicit permission are the key, getting consent through user interaction that is required anyway to complete the user-important task.

The tightrope we’re walking here is the line between what the page controls and what they don’t. What are the tools we use to enforce that the user clicking on the box in “[x] near my location”, actually allows a site to use location for this purpose only? Is this acceptable risk all things considered?

I guess my question in this example is, should the page be able to state what the location will be used for? Potentially a more nuanced user question can be generated (implicit or explicit), but pages can lie.

Yabber aside, I think understandable visual feedback on what a page is doing on your box would make things much better, and a whole class of questions could be safely delayed.

To realize this auditing goal, it seems like everything running in a browser as a result of a pages actions should be put in a bucket that we can audit. Namely, web plugins would need to be audited in the same way as browser built-in stuff… Now how might we accomplish that?

lloyd

“ASIDE: I would love to know how many people: a) download something from the Web, b) run it, c) see that dialog and then d) say “oh, OK no.” I know what I am willing to bet on ;)”
lol