From f1f017b6885fab132db5660ad970f34234d70082 Mon Sep 17 00:00:00 2001 From: hober Date: Fri, 24 May 2024 21:01:48 +0000 Subject: [PATCH] deploy: bf95472ea235acca2661650983c26d1b2a8f9ae3 --- cc0-80x15.png | Bin 319 -> 0 bytes index.html | 1486 +++++++++++++++++++++++++++++++++++-------------- 2 files changed, 1076 insertions(+), 410 deletions(-) delete mode 100644 cc0-80x15.png diff --git a/cc0-80x15.png b/cc0-80x15.png deleted file mode 100644 index 36c810b39e07df76ef7b9e45f58c2e44dba6fb7e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 319 zcmV-F0l@x=P)IWd0000pP)t-s|NsB* z@9*E=-_Os_zrVk)udknAP^7`0000C0(z_f z0075HL_t(|+O3n(ZiFBZMb9YRDhqo4|7-i8xY6CFNpV8R0GY$hg~6KxfutFT6cA6> zk$=YqT+9$fodb%6VeL`)a0w`?&Je4K+yksWVATAr2Fzy09-szHI%GA$=mHApZi=F! z$AQ;Pw>6Tiz~nkublS=(He5^E?5mt@w0jR=0g5G?PQVWeufTTRlCwfH7lr<%&=dQR zy?f~Jb@I?w-HiLi!#7}i<(lfw?tJCj{~?RdSEoen?i5DN0YeIi+S|)F#}5^XGHj2t R%Xt6*002ovPDHLkV1kKFkPiR= diff --git a/index.html b/index.html index 07e41aa..1f359ee 100644 --- a/index.html +++ b/index.html @@ -5,11 +5,12 @@ Self-Review Questionnaire: Security and Privacy - - + - - - + - - - - - + -

Self-Review Questionnaire: Security and Privacy

-

Editor’s Draft,

+

Editor’s Draft,

More details about this document
@@ -494,9 +600,8 @@

Self-Review Questionnaire: Security and Pri

Abstract

This document contains a set of questions to be used when - - evaluating the security and privacy implications of web platform - technologies.

+evaluating the security and privacy implications of web platform +technologies.

Status of this document

@@ -660,7 +765,7 @@

1. document will, we hope, inform your writing of those sections. It is not appropriate, however, to merely copy this questionnaire into those sections. Instructions for requesting security and privacy reviews can be -found in the document How to do Wide Review.

+found in the document How to do Wide Review.

When requesting a review from the Technical Architecture Group (TAG), please provide the TAG with answers @@ -1627,22 +1732,24 @@

, like this:

Note, this is an informative note.

-

Conformant Algorithms

-

Requirements phrased in the imperative as part of algorithms +

+

Conformant Algorithms

+

Requirements phrased in the imperative as part of algorithms (such as "strip any leading space characters" or "return false and abort these steps") are to be interpreted with the meaning of the key word ("must", "should", "may", etc) used in introducing the algorithm.

-

Conformance requirements phrased as algorithms or specific steps +

Conformance requirements phrased as algorithms or specific steps can be implemented in any manner, so long as the end result is equivalent. In particular, the algorithms defined in this specification are intended to be easy to understand and are not intended to be performant. Implementers are encouraged to optimize.

+

- +

Index

Terms defined by this specification

    @@ -1654,190 +1761,77 @@

    same-origin policy, in § 3.3
  • XSS, in § 3.3

- - - - - - - - - - - - - -

Terms defined by reference

  • [CSP] defines the following terms:
      -
    • connect-src -
    • form-action +
    • connect-src +
    • form-action
  • [ENCRYPTED-MEDIA] defines the following terms:
      -
    • content decryption module +
    • content decryption module
  • [HTML] defines the following terms:
      -
    • domain -
    • fully active -
    • iframe -
    • localStorage -
    • pdf viewer plugin objects -
    • sticky activation +
    • domain +
    • fully active +
    • iframe +
    • localStorage +
    • pdf viewer plugin objects +
    • sticky activation
  • [IndexedDB-3] defines the following terms:
      -
    • indexedDB +
    • indexedDB
  • [PERMISSIONS-POLICY] defines the following terms:
      -
    • policy-controlled feature +
    • policy-controlled feature
  • [STORAGE-ACCESS] defines the following terms:
      -
    • first-party-site context -
    • third-party context +
    • first-party-site context +
    • third-party context
  • [XHR] defines the following terms:
      -
    • FormData +
    • FormData

References

Normative References

[DESIGN-PRINCIPLES] -
Sangwhan Moon. Web Platform Design Principles. URL: https://w3ctag.github.io/design-principles/ +
Sangwhan Moon; Lea Verou. Web Platform Design Principles. URL: https://w3ctag.github.io/design-principles/
[HTML]
Anne van Kesteren; et al. HTML Standard. Living Standard. URL: https://html.spec.whatwg.org/multipage/
[IndexedDB-3] -
Ali Alabbas; Joshua Bell. Indexed Database API 3.0. URL: https://w3c.github.io/IndexedDB/ +
Joshua Bell. Indexed Database API 3.0. URL: https://w3c.github.io/IndexedDB/
[RFC2119]
S. Bradner. Key words for use in RFCs to Indicate Requirement Levels. March 1997. Best Current Practice. URL: https://datatracker.ietf.org/doc/html/rfc2119
[STORAGE-ACCESS] -
The Storage Access API URL: https://privacycg.github.io/storage-access/ +
The Storage Access API. Editor's Draft. URL: https://privacycg.github.io/storage-access/

Informative References

[ADDING-PERMISSION]
Nick Doty. Adding another permission? A guide. URL: https://github.com/w3cping/adding-permissions
[BATTERY-STATUS] -
Anssi Kostiainen; Mounir Lamouri; Raphael Kubo da Costa. Battery Status API. URL: https://w3c.github.io/battery/ +
Anssi Kostiainen; Raphael Kubo da Costa. Battery Status API. URL: https://w3c.github.io/battery/
[COMCAST]
David Kravets. Comcast Wi-Fi serving self-promotional ads via JavaScript injection. URL: http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/
[CORS]
Anne van Kesteren. Cross-Origin Resource Sharing. 2 June 2020. REC. URL: https://www.w3.org/TR/cors/
[CREDENTIAL-MANAGEMENT-1] -
Mike West. Credential Management Level 1. URL: https://w3c.github.io/webappsec-credential-management/ +
Nina Satragno. Credential Management Level 1. URL: https://w3c.github.io/webappsec-credential-management/
[CSP]
Mike West; Antonio Sartori. Content Security Policy Level 3. URL: https://w3c.github.io/webappsec-csp/
[DAP-PRIVACY-REQS] @@ -1899,153 +1893,825 @@

[YUBIKEY-ATTACK]
Andy Greenberg. Chrome Lets Hackers Phish Even 'Unphishable' YubiKey Users. URL: https://www.wired.com/story/chrome-yubikey-phishing-webusb/

- - - - - - + + \ No newline at end of file