Page MenuHomePhabricator

[WMDE-Fundraising] Investigate security settings for "sensitive banner"
Closed, ResolvedPublic5 Story Points

Description

from https://github.com/wmde/fundraising/issues/548
transfer of personal data from wikipedia.org to spenden.wikimedia.de

Event Timeline

Tobi_WMDE_SW raised the priority of this task from to Needs Triage.
Tobi_WMDE_SW updated the task description. (Show Details)
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 5 2015, 11:56 AM
Tobi_WMDE_SW triaged this task as Normal priority.Aug 5 2015, 11:56 AM
Tobi_WMDE_SW set Security to None.
Tobi_WMDE_SW edited a custom field.
WMDE-Fisch moved this task from Backlog to Doing on the TCB-Team-Fundraising-Sprint-2015-08-05 board.
WMDE-Fisch added a comment.EditedAug 7 2015, 10:51 AM

Investigation outcome:

It seems we can do it, but we have to have some things in mind:

  • HTTPS is working everywhere and the general encryption quality is very good
  • I assume we have to transmit the personal data via JSONP requests to our server
  • JSONP means everything is transmitted via the GET parameter ( we cannot AJAX-POST it to a local php script like on WP.de )
  • to secure the data in the GET ( dont want to have anything in the history or else ) we could use PGP encryption {1}[2][3]
  • older browser might have a problem with encryption but that is a general issue with older browsers since we have no fallback for theses systems anyway it should be no new issue
  • we should add a general fallback mechanism for unsupportet browsers or non working encryption in the banners
  • gadgets could read everything happening in the sensitive banner but we could say that is the responsibility of the user
  • the few "guidline" documents there are do not really forbid doing something like that {4}[5]

[1] https://github.com/HazAT/jCryption/
[2] https://github.com/openpgpjs/openpgpjs
[3] https://github.com/bitwiseshiftleft/sjcl
[4] https://meta.wikimedia.org/wiki/CentralNotice/Usage_guidelines
[5] https://meta.wikimedia.org/wiki/CentralNotice/Banner_guidelines

WMDE-Fisch closed this task as Resolved.Aug 12 2015, 12:18 PM
Addshore moved this task from Incoming to Done on the TCB-Team board.Nov 27 2015, 10:29 AM