Editorial: move UI suggestion to Priv/Sec section (#240)

Author: marcoscaceres

index.html

@@ -297,8 +297,9 @@ <h4>
                 </li>
                 <li>Present the user with a choice of one or more <a>share
                 targets</a>, selected at the user agent's discretion. The user
-                MUST be given the option to cancel rather than choosing any of
-                the share targets. Wait for the user's choice.
+                agent MUST give the user the option to cancel rather than
+                choosing any of the [=share targets=]. Wait for the user's
+                choice.
                 </li>
                 <li>If the user chose to cancel the share operation, [=queue a
                 global task=] on the [=user interaction task source=] using
@@ -356,18 +357,6 @@ <h4>
               </ol>
             </li>
           </ol>
-          <p>
-            The user agent MUST NOT allow the website to learn which share
-            targets are available, or the identity of the chosen target.
-          </p>
-          <div class="note">
-            {{Navigator/share()}} always shows some form of UI, to give the
-            user a choice of application and get their approval to invoke and
-            send data to a potentially native application (which carries a
-            security risk). For this reason, user agents are prohibited from
-            showing any kind of "always use this target in the future" option,
-            or bypassing the UI if there is only a single share target.
-          </div>
         </section>
         <section>
           <h3>
@@ -609,11 +598,17 @@ <h2>
         (depending on the underlying platform).
       </p>
       <ul>
-        <li>There is a requirement to not allow the website to learn which apps
-        are installed, or which app was chosen from {{Navigator/share()}},
-        because this information could be used for fingerprinting, as well as
+        <li>The API does not expose to the website which [=share targets=] are
+        available, or which share target was chosen by the user from
+        {{Navigator/share()}}. Doing so could be used for fingerprinting by
         leaking details about the user's device.
         </li>
+        <li>User agents are discouraged from showing any kind of "always use
+        this target in the future" option, or bypassing the UI if there is only
+        a single share target. Further, calls to {{Navigator.share()}} require
+        [=transient activation=] (i.e., some kind of user activation) before
+        any UI is presented to the user.
+        </li>
         <li>Implementors will want to carefully consider what information is
         revealed in the error message when {{Navigator/share()}} is rejected.
         Even distinguishing between the case where no targets are available and