definition of security is too weak

[dbaron]

The definition of security (currently "The system should preserve its integrity and functionality even when subject to attack.") appears (although it's a bit unclear) not to include revealing private information as a failure of security. Maintaining confidentiality of data that was intended to be kept confidential is generally considered part of security. I suspect there are likely also other topics that were omitted but should be included.

It may be preferable to link to an external definition.

(This was originally part of w3ctag/design-reviews#355 (comment) .)

[mlagally]

@dbaron Please take a look at the discussion in #368

When the revised PR is available, there will be a clear definition of security.

[mlagally]

Call on 22.8.: The PR #368 needs to be updated to contain a definition.

[mlagally]

Arch call on Aug 29th:

We decided to ask the PING experts for a recommendation:
w3cping/tracking-issues#12

[mmccool]

See PR #384.

[mlagally]

resolved by replacing it with ISO definitions in call on Sept 12