Limitations on TDs Utilising nosec

[harrisonsean]

This issue is part of the PING privacy review w3cping/privacy-request#84

This spec currently allows TDs to set nosec without restriction, however the spec also mentions that some TDs can contain IDs that are immutable by law (in some jurisdictions) and that some TDs can be associated with personal devices. Given this it seems reasonable to require that any device with an immutable ID or that can be associated with a personal device is forbidden from using nosec as a security policy.

[sebastiankb]

from today's TD call:

• @mmccool will address this issue with a PR
• @mmccool will also address this issue in the security TF

[mmccool]

I am working on a PR to address this and related matters, but I am putting it into WoT Architecture since it also relates to WoT Discovery. See w3c/wot-architecture#747
Unfortunately, access controls without TLS can be bypassed, and there is a general problem with using TLS on private networks, e.g. in the home. TLS can be set up in private networks with some difficulty but this is most appropriate in institutional environments, i.e. a factory. Many hubs etc. for the Smart Home don't support it in particular (due to lack of standards for properly setting up certs in such situations in a not-painful way). Please look at the above PR and let me know (by commenting on that PR) if it addresses this issue. I am attempting to codify some stronger statements about protecting remote access over the internet in particular.

[mmccool]

Some updated S&P considerations have been merged into Architecture, please review. I am doing a cleanup pass so let me know if you spot anything that needs to be addressed. See w3c/wot-architecture#753

[sebastiankb]

from today's TD call:

• @mmccool address this issue in the Arch TF by this PR Clean up new TLS S&P Considerations wot-architecture#753
• @mmccool will clean up and add some cross references from TD to architecture (a PR will provided)
• @harrisonsean we hope those actions are ok for you. If so we would close this issue then.

[harrisonsean]

These updates look good to me, closing the issue

[sebastiankb]

perfect, thanks