separate security and privacy considerations

Author: svgeesus

css-masking-1/Overview.bs

@@ -1267,7 +1267,7 @@ The 'mask-type' property allows the author of the <a element>mask</a> element to
 The 'mask-type' property is a <a href="https://www.w3.org/TR/2011/REC-SVG11-20110816/intro.html#TermPresentationAttribute">presentation attribute</a> for SVG elements.
 
 
-# Privacy and Security Considerations # {#priv-sec}
+# Privacy Considerations # {#priv}
 
 It is important that the timing to the masking operations is independent of the source and destination pixel. Masking operations must be implemented in such a way that they always take the same amount of time regardless of the pixel values. If this rule is not followed, an attacker could infer information and mount a timing attack.
 
@@ -1277,6 +1277,11 @@ A timing attack is a method of obtaining information about content that is other
 
 User agents must use the <a href="https://fetch.spec.whatwg.org/#main-fetch">potentially CORS-enabled fetch</a> method defined by the [[!FETCH]] specification for all <<mask-source>>, <<clip-source>> and <<image>> values on the 'mask-image', 'mask-border-source' and 'clip-path' properties. When fetching, user agents must use “Anonymous” mode, set the referrer source to the stylesheet's URL and set the origin to the URL of the containing document. If this results in network errors, the effect is as if the value ''mask-image/none'' had been specified.
 
+# Security Considerations # {#sec}
+
+No new security considerations have been raised on this specification.
+
+
 <h2 id="clip-property" class="no-num">Appendix A: The deprecated 'clip' property</h3>
 
 <pre class=propdef>