From 0884c3684dbe4cf3112b20d836e6fad531f48327 Mon Sep 17 00:00:00 2001 From: Robin Berjon Date: Wed, 8 May 2024 17:34:03 +0000 Subject: [PATCH] remove high level threats and reference RFC6973 instead (#421) SHA: fde250a0ad0bcaae9e2e9577dc094e803cff3c20 Reason: push, by darobin Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- index.html | 189 ++++++++--------------------------------------------- 1 file changed, 27 insertions(+), 162 deletions(-) diff --git a/index.html b/index.html index 6372b8b..72a646b 100644 --- a/index.html +++ b/index.html @@ -883,7 +883,7 @@

Privacy Principles

This document is governed by the 03 November 2023 W3C Process Document. -

+

How This Document Fits In

@@ -990,13 +990,13 @@

Privacy Principles

which may include: Internet service providers; other network operators; local institutions providing a network connection including schools, libraries, or universities; government intelligence services; malicious hackers who have gained access to the network or the systems of any of the other actors. -High-level threats including surveillance may be pursued by these actors. Pervasive monitoring, +High-level threats including surveillance may be pursued by these actors ([RFC6973]). Pervasive monitoring, a form of large-scale, indiscriminate surveillance, is a known attack on the privacy of users of the internet and the web [RFC7258].

Information flows may also involve other people — for example, other users of a site — which could include friends, family members, teachers, strangers, or government officials. Some -threats to privacy, including both disclosure and harassment, may be particular to the other -people involved in the information flow.

+threats to privacy, including both disclosure and harassment, may be particular to the other +people involved in the information flow ([RFC6973]).

1.1 Individual Autonomy

A person's autonomy is their ability to make decisions of their own personal will, without undue influence from other actors. People have limited intellectual resources and time with which to weigh decisions, and they have to rely on shortcuts when making decisions. This makes it possible @@ -1369,7 +1369,7 @@

Privacy Principles

trick other people into thinking a belief has more support than it really has. This violates the other people's rights to be free from manipulation.

On the other hand, identifying everyone with enough detail to detect these cases tends to -violate their rights to be free from surveillance and correlation.

+violate their rights to be free from surveillance and correlation. ([RFC6973])

-

B. High-Level Threats

- -

User agents should attempt to defend the people using them from a variety of high-level -threats or attacker goals, described in this section.

-

These threats are an extension of the ones discussed by [RFC6973].

-
-
Correlation - -
Correlation is the combination of various pieces of information related to an - individual or that obtain that characteristic when combined. See - RFC6973§5.2.1. - -
Data Compromise - -
End systems that do not take adequate measures to secure data from - unauthorized or inappropriate access. See RFC6973§5.1.2. - -
Disclosure - -
Disclosure is the revelation of information about an individual that affects - the way others judge the individual. See RFC6973§5.2.4. - -
Exclusion - -
Exclusion is the failure to allow individuals to know about the data that - others have about them and to participate in its handling and use. See - RFC6973§5.2.5. - -
Identification - -
Identification is the linking of information to a particular individual, even if the information -isn't linked to that individual's real-world identity (e.g. their legal name, address, government ID -number, etc.). Identifying someone allows a system to treat them differently from others, which can -be inappropriate depending on the context. See -RFC6973§5.2.2. - -
Intrusion - -
Intrusion consists of invasive acts that disturb or interrupt one’s life or - activities. See RFC6973§5.1.3. - -
Misattribution - -
Misattribution occurs when data or communications related to one individual - are attributed to another. See RFC6973§5.1.4. - -
Profiling
- -
The inference, evaluation, or prediction of an individual's attributes, interests, or -behaviours.
- -
Secondary Use - -
Secondary use is the use of collected information about an individual without - the individual’s consent for a purpose different from that for which the - information was collected. See RFC6973§5.2.3. - -
Surveillance - -
Surveillance is the observation or monitoring of an individual’s -communications or activities. See RFC6973§5.1.1. -
- -

These threats combine into the particular concrete threats we want web -specifications to defend against, described in the sections that follow.

-
- -

C. Principles Summary