Sunday, October 30, 2011

The Priority of Constituencies

Lawrence Lessig wrote in Code is Law that the choices we make in writing code embody our values.  This observation is especially true when building a browser because the browser mediates interactions between many distinct entities.  Because the browser's security policy is at the heart of mediating those interactions, we should ask ourselves what values the browser's security policy embodies.

One key value is the priority of constituencies, which is enshrined in the HTML Design Principles:
In case of conflict, consider users over authors over implementors over specifiers over theoretical purity.
To better understand this principle, let's consider a specific example: whether the browser's password manager should be enabled for a given web site.

The password manager is a source of conflict for these competing interests.  Implementors (myself included) believe that password managers improve security by reducing the costs of using a large number of more complex passwords.  Many banks, however, disagree.  They believe that password managers reduce security because passwords stored in password managers can be stolen by miscreants.

How do browser vendors resolve this conflict?  By default, we enable the password manager.  Because users have a higher priority than implementors (i.e., browser vendors), browsers let users turn the password manager off.  Because authors (i.e., site operators) also have a higher priority than browser vendors, browsers let authors disable the password manager on their own web sites by setting autocomplete=off.

The careful reader will have noticed that the scheme above violates the priority of constituencies in one case.  What if the user wants to use the password manager on a web site sets autocomplete=off?  Because users have a higher priority than authors, the browser should resolve this conflict in favor of the user.  Typically, browsers handle this case via their extension system.  For example, the autocomplete=on extension lets users override authors who want to disable the password manager.

How, then, should we respond to web site operators who wish to block or override these sorts of extensions?  As long as we believe that these extensions faithfully enact the user's will, we're hard-pressed to let authors block these extensions because that would violate the priority of constituencies.  Instead, we ask authors to be humble and accept the user as sovereign.

1,106 comments:

  1. As the author of that extension, let me also note that for a long time I've wanted to change Chrome so that its built-in UI lets users override site authors here.

    There is a difficulty, though, in that "autocomplete=off" is used in many types of data fields -- passwords, credit card numbers, and "fields it wouldn't be very useful for the browser to provide completions for later" are three distinct cases -- and while the right behavior may differ from case to case it's often hard for the browser to know which case a particular field represents.

    ReplyDelete
  2. Some users belong to an organization, which may have its own policies. Where do they fit in?

    ReplyDelete
  3. And today is your day, Peter.
    "As we’ve previously discussed, Chrome will now offer to remember and fill password fields in the presence of autocomplete=off. This gives more power to users in spirit of the priority of constituencies, and it encourages the use of the Chrome password manager so users can have more complex passwords. This change does not affect non-password fields." -Daniel Xie, Google Chrome, Chrome release blog

    ReplyDelete
  4. To see latest Tamil movie updates and reviews visit
    Latest Tamil Movie Reviews

    ReplyDelete
  5. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  6. Thanks for Nice and Informative Post. This article is really contains lot more information about This Topic.
    world famous astrologer

    ReplyDelete
  7. Thanks for providing such a great info, you can see Easter Greetings Sayings plz like and share this post. Thanks Regards

    ReplyDelete
  8. I hope KKR will win this year because the team have ability to beat all the teams playing in IPL 2016

    ReplyDelete
  9. Nice to be visiting your blog again, it has been months for me. Well this article that i've been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share.
    five nights at freddy's 3 five nights at freddy's 4 five nights at freddy's 2 five nights at freddy's

    ReplyDelete
  10. Indian Premiere League (IPL)Starting from April 9 to 29 May 2016.Check out latest IPL 2016 Schedule

    ReplyDelete
  11. This is a really super post. Must admit that you are amid the best writer I have read. I appreciate your making the effort to discuss this class of article.

    - usps tracking
    - iphone 7 release date
    - Netflix

    ReplyDelete
  12. It is the best time to make plans for the future and it's time to be happy. I have read this post and if I could I wish to suggest you few interesting things or advice.
    Maybe you could write next articles referring to this article. I want to read even more things about it. Great blog. Thanks!
    http://www.juegosfrivol.com/
    http://www.juegoskizi20.com/
    http://www.frivallgames.com/

    ReplyDelete
  13. Hi Admin,

    Great post indeed!
    ACtually I visit your blog first time through someone blog. So I bookmakred this page for further usage.
    Thanks for sharing such great content with us.

    Happy Mothers Day 2016 | Happy Mothers Day Wishes | Happy Mothers Day Messages | Happy Mothers Day Quotes | Happy Mothers Day Sms | Happy Mothers Day Images


    Regards:
    Hafiz Junaid

    ReplyDelete
  14. Thanks for the great post. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts.
    impossible quiz
    learn to fly
    minecraft unblocked
    plazma burst 2
    qwop
    superfighters
    raze

    ReplyDelete
  15. Good blog post. I want to thank you for interesting and helpful information and I like your point of view. Thank you!
    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  16. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    earn to die
    Hi! I’ve been reading your blog for a while now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    tank trouble
    tank trouble

    earn to die 1

    earn to die 2

    earn to die 3

    tank trouble 4
    tank trouble 3
    tank trouble 2

    ReplyDelete
  17. Thanks for the best blog.it was very useful for me.keep sharing such idea
    s in the future as well.this was actually what i was looking for,and i
    am glad to came here
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3

    ReplyDelete
  18. This content is written very well. Your use of formatting when making your points makes your observations very clear and easy to understand. Thank you.
    - usps tracking
    - iphone 7 release date
    - netflix

    ReplyDelete
  19. This comment has been removed by the author.

    ReplyDelete
  20. Great! Thanks for sharing the information. That is very helpful for increasing my knowledge in this fiel.A good blog Apple Shooter . Thanks for sharing the information. It is very useful for my future. Stickman Games keep sharing
    Signature: Stickman Games

    ReplyDelete
  21. Love Status in Hindi: Hii Friends whatsapp status Today I am going to share with you a Best Hindi love Status for Whatsapp.
    status for whatsapp
    These Love status are Hurts touch status for girlfriends and boyfriends.best whatsapp statusThese status are written is hindi and english language.
    Now every one want the best love heart touch status for her or for him.love status for whatsapp So that why I am publishing a these collection of love whatsapp status in Hindi.
    This our specialy status site from our site you can get..Click Here for more


    ReplyDelete
  22. Thanks, you guys that is a great explanation. keep up the good work in your granite blog !
    - slither.io
    - wings.io
    - vanar.io
    - lazerdrive.io
    - diep.io

    ReplyDelete
  23. Diep.io is a new addition in which you control a tank and shoot down both obstacles and opponents.Diep.io, which is quickly becoming the next Agar.io style game sensation. Diep.io game is a funny muliplayer tanks shooting game. Control a tank, shoot opponents and obstacles, upgrade your tank while trying to keep alive.

    ReplyDelete
  24. Movesure has a fine team of highly skilled and well-trained staff. The Packers and Movers in Faridabad has a staff that work with utmost care and dedication to provide the best service according to your budget.

    ReplyDelete
  25. The packers and movers in Delhi understand care of the troublesome and stressful job of varying from one desired location to substitute without your effect. The relocation foster from movesure is over and finished along together amid in view of that without any defer.

    ReplyDelete
  26. Well this article that i've been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share.
    dark souls 3 emoji
    slitherio supersnakeio

    ReplyDelete
  27. solidworks crack
    solidworks download
    solidworks tutorial
    learn solidworks online
    http://solidworkscrack.blogspot.com/
    http://solidworkscrack.blogspot.com/2016/06/solidworks-free-download-full-version.html
    http://solidworkscrack.blogspot.com/2016/06/learn-solidworks-tutorials-online.html http://solidworkscrack.blogspot.com/2016/06/learn-solidworks-tutorials-online.html

    ReplyDelete
  28. Thank you for sharing valuable information. Nice post. I enjoyed reading this post.Can you play more games at :
    red ball 4 | ninjago games | red ball 3 | ninjago games

    ReplyDelete
  29. Thank you for sharing valuable information. Nice post. I enjoyed reading this post.Can you play more games at :
    red ball 4 | ninjago games | red ball 3 | ninjago games

    ReplyDelete
  30. Welcomes to google terminal keep sharing such ideas in the future as well.
    google snake this was actually EARN TO DIE
    what i was looking for,and i am glad to came here! AGE OF WAR 2
    Hi! I’ve been reading your blog for a while HAPPY WHEELS
    I want you to thank for your time of this wonderful read!!! Slitherio
    Amazing insight you have on this, Slither io This article always blew me BIG FARM

    ReplyDelete
  31. Great post,Thanks for providing us this great knowledge,Keep it up.
    red ball 4 | ninjago games | red ball 3 | ninjago games

    ReplyDelete
  32. Good blog post. I want to thank you for interesting and helpful information and I like your point of view. Thank you!
    slither io | wings io | science kombat | tank trouble 4

    ReplyDelete
  33. Hi i was browsing your blog and i found it really interesting! i too have a website.Kindly check it out here
    Rajhans Residency Noida Extension
    Rajhans Residency Noida
    Rajhans Residency

    ReplyDelete
  34. You topic is very great and useful for us…Thank you for that information you article.
    Signature:
    Money Lender

    ReplyDelete
  35. This article always blew me... For how many times I have read this. The overwhelming feeling never changes.
    contact form, snapchat emoji

    ReplyDelete
  36. Hi i was browsing your blog and i found it really interesting! i too have a website.Kindly check it out here
    Galaxy Blue Sapphire Plaza
    Galaxy Blue Sapphire Noida Extension
    Galaxy Blue Sapphire
    Galaxy Blue Sapphire Plaza Noida

    ReplyDelete
  37. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    kids games free | games games | shooting games | tank games | apple shooter | stick war 2 | unblocked games

    ReplyDelete
  38. Always so interesting to visit your site.What a great info, thank you for sharing. this will help me so much in my learning

    Digibrand
    ClarifyCredit

    ReplyDelete
  39. I want to share any applications example baixar snapchat, google play and play store. Snapchat is app which everybody like, it's chat app. Baixar google play and play store are two applications of google. It allows you download applications and games which you like. Please, baixar play store to mobile to experience

    ReplyDelete

  40. this is one of the cult game now, a lot of people enjoy playing them . Also you can refer to the game :
    age of war | earn to die 5 | Tank trouble | happy wheels | earn to die 6
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    tank trouble unblocked | wings io | strike force heroes

    ReplyDelete
  41. One of the best trending punjabi status WhatsApp statuses online is the Hindi whatsapp dp.
    For those who like to put their status in Hindi, a lot of WhatsApp status in Hindi is available for them to use and post in their attitude status
    whatsapp profile pic.and dp for whatsapp
    These people can have the best and most interesting Hindi whatsapp status through our wide range of collection
    of whatsapp status in hindi updated daily.
    You can check out cool best whatsapp status,
    status, funny, interesting and all sorts of Hindi status and descriptions for your profile.
    Here you can find a collection of heartfelt descriptions and Hindi
    status for whatsapp.
    It will be a great way for you to share sad status your feelings
    and mindset creatively good morning image.

    ReplyDelete
  42. Posts shared useful information and meaningful life, I'm glad to be reading this article and hope to soon learn the next article. thank you

    monkey go happy | mahjong| superfighters 2 |yahtzee with buddies

    ReplyDelete
  43. Wonderful blog! I found it while searching on Yahoo News. Do you have any suggestions on how to get listed in Yahoo News? I’ve been trying for a while but I never seem to get there! Many thanks.
    tanki online | animal jam 2 | 2048 game | stick war 2 |stickman games |five nights at freddy’s 2 |five nights at freddy’s 4 |plants vs zombies | gold mine strike

    ReplyDelete