New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Privacy Interest Group (PING) review #204

Closed
iherman opened this Issue Apr 9, 2016 · 13 comments

Comments

Projects
None yet
7 participants
@iherman
Member

iherman commented Apr 9, 2016

(This review came in via email, sent by Greg Norcie gnorcie@cdt.org. I have copied the text to the issue with only formatting changes. IH.)

Hi all,

Ivan Herman reached out to PING to share a trio of documents relating to the Web Annotation model:

  • The Web Annotation Protocol[1]
  • The Web Annotation Vocabulary[2]
  • The Web Annotation Data Model[3]

Together, these documents propose a way for “annotation servers” to be set up, which can manage and store annotations about websites.

To start off, I wanted to list off some high level takeaways I gathered. I have also included a run through of the PING privacy questionnaire[4] I developed.

  1. Annotations, like all other internet traffic should probably be sent via HTTPS. The IETF has termed pervasive monitoring as an “attack[4], recommending all traffic be sent over HTTPS to avoid said attack. Similarly, the United States CIO has stated that “All browsing activity should be considered private and sensitive. An HTTPS-Only standard will eliminate inconsistent, subjective determinations across agencies regarding which content or browsing activity is sensitive in nature”. [5]
  2. I wasn’t clear reading this spec: Are annotation servers always controlled by the operators of a given site? Or can one annotation server annotate any website? Regardless, there there be an opt out mechanism, similar to a robots.txt on a standard web page? I especially worry about the issue of harassment, which has been raised with other annotation services like Genius[7].
  3. Finally, I feel it’s important that there be mechanisms to edit and delete annotations. Annotation servers should not be “write only”. In other contexts such as on Facebook[8], users often regret the data they upload - I expect that the annotation servers will have similar incidents.

In addition to these high level takeaways, below I have walked through the PING Privacy Questionnaire and included my responses. I encourage other standards developers to consider using the self questionnaire - and I welcome feedback on how this questionnaire can better help spec authors perform privacy audits:

  • Does this specification have a "Privacy Considerations" section?
    • Not currently.
  • Does this specification collect personally derived data?
    • No. Users could put personal data in a tag if they chose, but that is not something the spec specifically asks for or encourages.
  • Does this specification generate personally derived data, and if so how will that data be handled?
    • No, this standard does not directly generate identifiable information such as audio or video.
  • Does this standard allow an origin direct access to a user’s location, and if so is that information minimized?
    • No, the Annotation Protocol does not collect location data.
  • How should this specification work in the context of a user agent’s "incognito" mode?
    • The same as without, assuming the server is accessed via the browser.
  • Is it possible to spoof/fake the data being generated for privacy purposes?
    • I assume users could use a proxy, VPN, or Tor to access the annotation server.
  • Does the standard utilize data that is personally-derived, i.e. derived from the interaction of a single person, or their device or address?
    • No.
  • Does the data record contain elements that would enable re-correlation when combined with other datasets through the property of intersection (commonly known as "fingerprinting")?
    • However I would like to point out that PING has previously discussed sensor-specific question that can get at cross-device or cross-UA signaling. (The Vibration API). Can I get a volunteer to submit a pull request to add language that would add language to capture this threat model to the existing questionnaire?
  • Is the user likely to know if information is being collected?
    • Yes, users must expressly navigate to and utilize the annotation server.
  • Can the user easily, preferably through an element of the GUI, revoke consent granted to a particular feature?
    • Again, not clear if users will have the ability to delete/edit annotations. Hopefully there will be a discussion on this feature - users often regret posts on social media[8], and it’s important they be able to delete their posts.
  • Once consent has been given, is there a mechanism whereby it can be automatically revoked after a reasonable, or user configurable, period?
    • I’m not 100% clear, but I would hope that users can delete their annotations if they choose to do so.
  • Does this standard utilize strong end to end encryption?
    • I see no mention of using HTTPS in this standard. I’d like to see language added that Annotation servers must use TLS.
@iherman

This comment has been minimized.

Show comment
Hide comment
@iherman

iherman Apr 11, 2016

Member

For the record: see also the extra commen of Joseph Lorenzo Hall: https://lists.w3.org/Archives/Public/public-annotation/2016Apr/0036.html

Member

iherman commented Apr 11, 2016

For the record: see also the extra commen of Joseph Lorenzo Hall: https://lists.w3.org/Archives/Public/public-annotation/2016Apr/0036.html

@josephlhall

This comment has been minimized.

Show comment
Hide comment
@josephlhall

josephlhall Apr 11, 2016

That's @gregnorc, btw. (I'm from cdt.org too)

josephlhall commented Apr 11, 2016

That's @gregnorc, btw. (I'm from cdt.org too)

@azaroth42

This comment has been minimized.

Show comment
Hide comment
@azaroth42

azaroth42 Apr 14, 2016

Collaborator

Re deletion: Yes, you can use HTTP DELETE to delete Annotations.
See: https://www.w3.org/TR/annotation-protocol/#delete-an-existing-annotation

Re HTTPS: we should add a recommendation in a security considerations. I personally expect that all create/update/delete operations will be done over HTTPS, but we should be explicit.

Re opt-out: I disagree with this one. It would be like saying that an external web site can't link to your site. Robots.txt doesn't prevent linking, it advertises preferences regarding crawling.

Collaborator

azaroth42 commented Apr 14, 2016

Re deletion: Yes, you can use HTTP DELETE to delete Annotations.
See: https://www.w3.org/TR/annotation-protocol/#delete-an-existing-annotation

Re HTTPS: we should add a recommendation in a security considerations. I personally expect that all create/update/delete operations will be done over HTTPS, but we should be explicit.

Re opt-out: I disagree with this one. It would be like saying that an external web site can't link to your site. Robots.txt doesn't prevent linking, it advertises preferences regarding crawling.

@iherman

This comment has been minimized.

Show comment
Hide comment
@iherman

iherman Apr 15, 2016

Member

Re HTTPS: we should add a recommendation in a security considerations. I personally expect that all create/update/delete operations will be done over HTTPS, but we should be explicit.

+1

Member

iherman commented Apr 15, 2016

Re HTTPS: we should add a recommendation in a security considerations. I personally expect that all create/update/delete operations will be done over HTTPS, but we should be explicit.

+1

@iherman

This comment has been minimized.

Show comment
Hide comment
@iherman

iherman Apr 15, 2016

Member

Are annotation servers always controlled by the operators of a given site? Or can one annotation server annotate any website? Regardless, there there be an opt out mechanism, similar to a robots.txt on a standard web page? I especially worry about the issue of harassment, which has been raised with other annotation services like Genius[7].

The issue of harassment, and what to do about it, is more complex and I am not sure that a single step (like some opt-out mechanism) is the right solution. (And, to be clear, I do not have the right answer either). @azaroth42 's reaction is absolutely valid and just shows that this issue is more general.

I believe finding the right solution would require much more discussion, involving the community at large, and I do not think this Working Group is in position to make a decision right now. A hasty step, like introducing an opt-out approach, may do more harm than good overall if we are not careful. My proposal would be not to make any technical changes on the documents now, continue the discussion in this group and elsewhere, and possibly add some extra features later (eg, version 2) when we have a consensus on a clearer approach. Otherwise this would fatally delay this group's work.

Note that there will be a panel discussion at I Annotate, right after the upcoming F2F meeting in Berlin. That may help in clarifying the possible options.

Member

iherman commented Apr 15, 2016

Are annotation servers always controlled by the operators of a given site? Or can one annotation server annotate any website? Regardless, there there be an opt out mechanism, similar to a robots.txt on a standard web page? I especially worry about the issue of harassment, which has been raised with other annotation services like Genius[7].

The issue of harassment, and what to do about it, is more complex and I am not sure that a single step (like some opt-out mechanism) is the right solution. (And, to be clear, I do not have the right answer either). @azaroth42 's reaction is absolutely valid and just shows that this issue is more general.

I believe finding the right solution would require much more discussion, involving the community at large, and I do not think this Working Group is in position to make a decision right now. A hasty step, like introducing an opt-out approach, may do more harm than good overall if we are not careful. My proposal would be not to make any technical changes on the documents now, continue the discussion in this group and elsewhere, and possibly add some extra features later (eg, version 2) when we have a consensus on a clearer approach. Otherwise this would fatally delay this group's work.

Note that there will be a panel discussion at I Annotate, right after the upcoming F2F meeting in Berlin. That may help in clarifying the possible options.

@BigBlueHat

This comment has been minimized.

Show comment
Hide comment
@BigBlueHat

BigBlueHat Apr 15, 2016

Member

"The issue of harassment" is about publication, not annotation.

Annotation is initially a singular, personal action (it may stay in your browser, or in that book you bought last year). Until you publish it, your evil side notes don't effect anyone and can't therefore be consider "harassment." Once published, however, the story changes.

Publication spaces (i.e. annotation social networks such as Genius and Hypothes.is) come with (necessary) community guidelines. One of those could (and usually do) include "un-publishing" and/or moderating annotations that run afoul of those guidelines. The user's right to annotate however should not be prohibited, though their ability to publish may be curtailed based on the guidelines set by the specific publisher.

At the very least, we need to keep the act of "annotating" separate from the act of "publishing."

Member

BigBlueHat commented Apr 15, 2016

"The issue of harassment" is about publication, not annotation.

Annotation is initially a singular, personal action (it may stay in your browser, or in that book you bought last year). Until you publish it, your evil side notes don't effect anyone and can't therefore be consider "harassment." Once published, however, the story changes.

Publication spaces (i.e. annotation social networks such as Genius and Hypothes.is) come with (necessary) community guidelines. One of those could (and usually do) include "un-publishing" and/or moderating annotations that run afoul of those guidelines. The user's right to annotate however should not be prohibited, though their ability to publish may be curtailed based on the guidelines set by the specific publisher.

At the very least, we need to keep the act of "annotating" separate from the act of "publishing."

@shepazu

This comment has been minimized.

Show comment
Hide comment
@shepazu

shepazu Apr 15, 2016

Member

What @BigBlueHat said, and even more to the point, whether a published annotation is displayed in context of the target content.

Member

shepazu commented Apr 15, 2016

What @BigBlueHat said, and even more to the point, whether a published annotation is displayed in context of the target content.

@dwhly

This comment has been minimized.

Show comment
Hide comment
@dwhly

dwhly Apr 15, 2016

Another way to think about this distinction:

"Publishing" is the act of making something "Public" to some group, i.e. "Known" to that group. So, preferences that page owners might signal to annotation services probably should revolve probably primarily around the notion of publishing-- just as @BigBlueHat has indicated.

In other words, it doesn't make sense for a page owner to say "You can't make a personal annotation here", because no one else will know about that annotation, we can't and shouldn't try to limit people's freedom to record and think for personal purposes (special note of curiosity: some fora, such as special viewing rooms inside congress for highly sensitive documents do restrict the ability to bring writing implements in) if for no other reason than that there are plenty of ways to do that. When you annotate personally, you are indeed annotating and not publishing.

A curious middle ground is around groups. I asked one of our interviewees recently about whether page owners should have a voice in whether their content was annotated within private group, since clearly that should be ok, right? She pointed me to the example of "Slam Books", which are (or were) apparently a thing in grade school, and potentially wider places.

The point was that even when things are discussed in private groups, they often can be damaging-- even if the target of that discussion is never aware of the specific contents of the discussion.

I don't have a personal conclusion here (and obviously my preferences run towards freedoms and not restrictions), but I just wanted to note that this was an interesting consideration that I hadn't thought of before.

dwhly commented Apr 15, 2016

Another way to think about this distinction:

"Publishing" is the act of making something "Public" to some group, i.e. "Known" to that group. So, preferences that page owners might signal to annotation services probably should revolve probably primarily around the notion of publishing-- just as @BigBlueHat has indicated.

In other words, it doesn't make sense for a page owner to say "You can't make a personal annotation here", because no one else will know about that annotation, we can't and shouldn't try to limit people's freedom to record and think for personal purposes (special note of curiosity: some fora, such as special viewing rooms inside congress for highly sensitive documents do restrict the ability to bring writing implements in) if for no other reason than that there are plenty of ways to do that. When you annotate personally, you are indeed annotating and not publishing.

A curious middle ground is around groups. I asked one of our interviewees recently about whether page owners should have a voice in whether their content was annotated within private group, since clearly that should be ok, right? She pointed me to the example of "Slam Books", which are (or were) apparently a thing in grade school, and potentially wider places.

The point was that even when things are discussed in private groups, they often can be damaging-- even if the target of that discussion is never aware of the specific contents of the discussion.

I don't have a personal conclusion here (and obviously my preferences run towards freedoms and not restrictions), but I just wanted to note that this was an interesting consideration that I hadn't thought of before.

@tbdinesh

This comment has been minimized.

Show comment
Hide comment
@tbdinesh

tbdinesh Apr 15, 2016

A bit more.

"The issue of harassment" is about (harassing) publication about someone
anywhere and not just on "their page".

On another note, its about finding these publications. Imagine the
annotations on a page are also indexed by search engines.

On Fri, Apr 15, 2016 at 8:28 PM, BigBlueHat notifications@github.com
wrote:

"The issue of harassment" is about publication, not annotation.

Annotation is initially a singular, personal action (it may stay in your
browser, or in that book you bought last year). Until you publish it, your
evil side notes don't effect anyone and can't therefore be consider
"harassment." Once published, however, the story changes.

Publication spaces (i.e. annotation social networks such as Genius and
Hypothes.is) come with (necessary) community guidelines. One of those could
(and usually do) include "un-publishing" and/or moderating annotations that
run afoul of those guidelines. The user's right to annotate however
should not be prohibited, though their ability to publish may be
curtailed based on the guidelines set by the specific publisher.

At the very least, we need to keep the act of "annotating" separate from
the act of "publishing."


You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#204 (comment)

tbdinesh commented Apr 15, 2016

A bit more.

"The issue of harassment" is about (harassing) publication about someone
anywhere and not just on "their page".

On another note, its about finding these publications. Imagine the
annotations on a page are also indexed by search engines.

On Fri, Apr 15, 2016 at 8:28 PM, BigBlueHat notifications@github.com
wrote:

"The issue of harassment" is about publication, not annotation.

Annotation is initially a singular, personal action (it may stay in your
browser, or in that book you bought last year). Until you publish it, your
evil side notes don't effect anyone and can't therefore be consider
"harassment." Once published, however, the story changes.

Publication spaces (i.e. annotation social networks such as Genius and
Hypothes.is) come with (necessary) community guidelines. One of those could
(and usually do) include "un-publishing" and/or moderating annotations that
run afoul of those guidelines. The user's right to annotate however
should not be prohibited, though their ability to publish may be
curtailed based on the guidelines set by the specific publisher.

At the very least, we need to keep the act of "annotating" separate from
the act of "publishing."


You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#204 (comment)

@iherman

This comment has been minimized.

Show comment
Hide comment
@iherman

iherman May 18, 2016

Member

Discussed at F2F, 18.05.16: Add a recommendation for HTTPS into the protocol spec

See http://www.w3.org/2016/05/18-annotation-irc#T12-38-52

Member

iherman commented May 18, 2016

Discussed at F2F, 18.05.16: Add a recommendation for HTTPS into the protocol spec

See http://www.w3.org/2016/05/18-annotation-irc#T12-38-52

@iherman

This comment has been minimized.

Show comment
Hide comment
@iherman

iherman May 18, 2016

Member

Re deletion: Yes, you can use HTTP DELETE to delete Annotations.
See: https://www.w3.org/TR/annotation-protocol/#delete-an-existing-annotation

That sub-issue is therefore closed

Member

iherman commented May 18, 2016

Re deletion: Yes, you can use HTTP DELETE to delete Annotations.
See: https://www.w3.org/TR/annotation-protocol/#delete-an-existing-annotation

That sub-issue is therefore closed

@iherman iherman added editor_action and removed telco labels May 18, 2016

@iherman

This comment has been minimized.

Show comment
Hide comment
@iherman

iherman May 18, 2016

Member

Per opt-out issue: Discussed at F2F, 18.05.16, We will defer work on signalling mechanisms regarding opt-out of annotation to a future version of the specifications

See http://www.w3.org/2016/05/18-annotation-irc#T12-45-58

Member

iherman commented May 18, 2016

Per opt-out issue: Discussed at F2F, 18.05.16, We will defer work on signalling mechanisms regarding opt-out of annotation to a future version of the specifications

See http://www.w3.org/2016/05/18-annotation-irc#T12-45-58

@azaroth42

This comment has been minimized.

Show comment
Hide comment
@azaroth42

azaroth42 May 18, 2016

Collaborator

Closing, making a new more specific editor action for recommending HTTPS in Protocol...

Collaborator

azaroth42 commented May 18, 2016

Closing, making a new more specific editor action for recommending HTTPS in Protocol...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment