[css-masking-1] The privacy review and suggestion

[NalaGinrut]

Hi folks!
First, thanks for the hard work! This is a privacy review from PING.

The self-review of css-masking-1 about privacy is good. However, we still have a little concern, here's the suggested text that should be added into the Privacy and Security Considerations section:

While CSS capabilities like those defined in CSS Masking Module Level 1 can be used to hide content from a site visitor, Web developers should not use these features to hide sensitive content from users or page scripts. Content that is hidden from a user's display via CSS can still be accessed and read from page scripts or form submissions. Web developers should treat the capabilities in this spec (as with all CSS specs) as cosmetic changes only, and not imposing or defending a privacy boundary.

It's appreciated if you can add the text.
Thanks!

The related discussion of PING is here w3cping/privacy-request#50

[svgeesus]

That sounds like a very reasonable concern to raise. Thanks!

[svgeesus]

Thanks, added!

[svgeesus]

@NalaGinrut could you confirm for the record that this edit satisfies the privacy concern?

[samuelweiler]

look good to me.

[svgeesus]

Thanks, @samuelweiler

[NalaGinrut]

look good to me too ;-)