Add privacy concerns README

[rsolomakhin]

This pull request is for a privacy concerns README, mainly touching on Payment Request and Payment Handler APIs.

Preview: https://github.com/rsolomakhin/webpayments/blob/gh-pages/privacy/issues/README.md

[rsolomakhin]

@stephenmcgruer PTAL

[stephenmcgruer]

cc @ianbjacobs ; this is the list I mentioned to you, which I hope to introduce at WPWG next week and then likely discuss at TPAC. Happy to have this sit as a pull request if that's the easiest way to handle it, or happy to see it merged - let us know :)

[ianbjacobs]

@dcrousso

[ianbjacobs]

@rsolomakhin, regarding the proposal to remote PaymentInstruments, see related issue:
w3c/payment-handler#371

[ianbjacobs]

@rsolomakhin, should we merge this ?

[stephenmcgruer]

Merging SGTM.

One thing to maybe consider before we do so - I think this is written from the 'voice' of the Google Chrome team (says 'we will do X' a lot), but may not be clearly marked as such. We should probably either:

1. Change 'we' to 'Google Chrome' throughout, or
2. (Easier) add a note at the top saying that this from the Google Chrome viewpoint

Thoughts @ianbjacobs ?

[ianbjacobs]

I have an alternative proposal. It looks like there are four main issues. Rather than add this to the generic WG repo, how about instead we raise the issues on the relevant specification?

For the background / assumptions, perhaps we could create a new document in the payment-handler repo on privacy assumptions and requirements. We could even model it after what we did for SPC:
https://github.com/w3c/secure-payment-confirmation/blob/main/requirements.md

I'm not suggesting that we do a full requirements exercise, only that we create a repository for them and start with what you've identified. I'm happy to create this document, which could then be referenced from the individual issues.

Thoughts?

Ian

[stephenmcgruer]

That plan seems ok from my perspective. Our core goal was to make sure our plans were in the public where people could see them (and raise any concerns), hence this write-up. If you would rather split them out, sgtm, though mostly because you're offering to take on the burden ;)

[ianbjacobs]

Hi @ @rsolomakhin and @stephenmcgruer,

I've created four issues on the payment handler API based on your writeup:
w3c/payment-handler#413
w3c/payment-handler#414
w3c/payment-handler#415
w3c/payment-handler#416

I did not create an issue related to removal of Instruments because that has been done:
w3c/payment-handler#409

I also updated the verbiage of #414 to reflect that removal.

For the moment I have not created a requirements document, and I'm not sure one is needed at this point. I propose that if we perceive the need we create it.

If you are satisfied with how this content has been migrated to the PH API repo, feel free to close this pull request.

Cheers!

[stephenmcgruer]

Thanks Ian - I am happy for this to be closed in favour of the opened issues