Merge pull request #49 from mounirlamouri/master

Write Privacy & Security Considerations section and update questionnaire.

Author: Manishearth

index.bs

@@ -211,13 +211,20 @@ The [=XR Compositor=] MUST NOT automatically grant the page access to any additi
 
 NOTE: Developers may request access to an [=/XR Device=]'s camera, should one be exposed through the existing [Media Capture and Streams](https://www.w3.org/TR/mediacapture-streams/) specification. However, doing so does not provide a mechanism to query the {{XRRigidTransform}} between the camera's location and the [=native origin=] of the [=viewer reference space=]. It also does not provide a guaranteed way to determine the camera intrinsics necessary to match the view of the [=real-world environment=]. As such, performing effective computer vision algorithms wil be significantly hampered. Future modules or specifications may enable such functionality.
 
-Security, Privacy, and Comfort Considerations {#security}
-=============================================
+Privacy & Security Considerations {#privacy-security}
+=================================
 
-Protected functionality {#protected-functionality}
------------------------
+<section class="non-normative">
+
+The AR Module does not provide new information compared to the WebXR Device API
+specification it is extending. It allows websites to start an XR session as
+{{XRSessionMode/"immersive-ar"}} which blends the real world behind the XR
+scene. The website does not have access to the real world information (camera
+images) but knows how the XR scene will be composited on top of the real world
+(blend mode).
 
-ISSUE: add information about new threats and mitigations introduced by functionality in this module
+Even if this module does not allow websites to access the camera images, it may
+not be obvious to end users and user agents may want to clarify this.
 
 </section>
 

security-privacy-questionnaire.md

@@ -90,7 +90,7 @@ This specification does not mandate a difference in behaviour.
 **Does this specification have a "Security Considerations" and "Privacy
 Considerations" section?**
 
-Yes. It is WIP as of answering this questionnaire.
+Yes.
 
 **Does this specification allow downgrading default security characteristics?**