16:54:49 <RRSAgent> RRSAgent has joined #webauthn
16:54:49 <RRSAgent> logging to http://www.w3.org/2017/05/24-webauthn-irc
16:54:51 <trackbot> RRSAgent, make logs public
16:54:51 <Zakim> Zakim has joined #webauthn
16:54:53 <trackbot> Zakim, this will be
16:54:53 <Zakim> I don't understand 'this will be', trackbot
16:54:54 <trackbot> Meeting: Web Authentication Working Group Teleconference
16:54:54 <trackbot> Date: 24 May 2017
16:55:48 <weiler> agenda: https://lists.w3.org/Archives/Public/public-webauthn/2017May/0247.html
16:55:58 <weiler> weiler has changed the topic to: agenda for 24 May: https://lists.w3.org/Archives/Public/public-webauthn/2017May/0247.html
16:59:40 <selfissued> selfissued has joined #webauthn
17:00:54 <weiler> present+ weiler
17:01:18 <wseltzer> present+
17:02:48 <jyasskin> present+
17:02:58 <selfissued> selfissued has joined #webauthn
17:03:30 <selfissued> selfissued has left #webauthn
17:03:41 <selfissued_> selfissued_ has joined #webauthn
17:03:52 <selfissued_> present+
17:05:06 <weiler> present+ nadalin, KetanMehta, jcj_moz, AkshayKumar
17:05:55 <Rolf> Rolf has joined #webauthn
17:07:11 <Ketan> Ketan has joined #webauthn
17:07:22 <jeffh> jeffh has joined #webauthn
17:07:25 <weiler> regrets+ angelo
17:08:18 <jeffh> present+ jeffh
17:08:21 <weiler> present+ alexei
17:08:34 <alexei-goog> alexei-goog has joined #webauthn
17:08:41 <weiler> scribenick: weiler
17:08:42 <alexei-goog> present+
17:09:00 <gmandyam> gmandyam has joined #webauthn
17:09:03 <weiler> topic: https://github.com/w3c/webauthn/pull/375
17:09:09 <weiler> nadalin: just editorial
17:09:09 <gmandyam> present+ gmandyam
17:09:16 <weiler> [we said the same thing last week!]
17:09:21 <weiler> topic: https://github.com/w3c/webauthn/pull/379
17:09:44 <weiler> [last week we were waiting for google]
17:10:23 <weiler> nadalin: I'll talk w/ angelo to make sure he addresses.
17:10:30 <weiler> topic: https://github.com/w3c/webauthn/pull/427
17:10:41 <weiler> jeffh: queued for after 464
17:11:05 <weiler> ... cover 464 out of order since we have limited time from jyasskin
17:11:14 <weiler> topic: https://github.com/w3c/webauthn/pull/464
17:11:28 <weiler> jeffh: have not addressed detailed comments from jyasskin yet
17:11:59 <weiler> ... note on rpid definition, gopefulyl addressing 260
17:12:04 <weiler> s/260/issue 260/
17:12:25 <weiler> ... jyasskin raises suborigins.  I need to read this.  is it implemented?
17:12:40 <weiler> jyasskin: i think not.  stalled for a while.  may be some new activity.  something to think about.
17:13:00 <weiler> jeffh: punt on suborigins and go ahead and merge 464?
17:13:16 <weiler> jyasskin: even we're revisiting ports, makes sense to merge this.
17:13:33 <weiler> jeffh: we do NOT want to include the port.
17:13:43 <weiler> ... we have to match HSVS and cookies; they are whole-host.
17:13:50 <weiler> s/have/want/
17:13:56 <jcj_moz> s/HSVS/HSTS/
17:14:04 <weiler> jyasskin: that answers my concern
17:15:02 <weiler> nadalin: jyasskin will review? (even w/o jeffh hasn't finished w/ details)
17:15:25 <weiler> jeffh: want to work more on it.  want review of this AM's changes.  goal to merge Friday/Monday.  want to get this done and go back to 427.
17:15:37 <weiler> nadalin: monday is holiday.  goal of tuesday.
17:15:51 <weiler> jyasskin: will et this reviewed.  don't expect signifiant problems.
17:15:59 <weiler> jeffh: *cackles*
17:16:10 <weiler> s/et this/get this/
17:16:26 <weiler> ... more reviewers good.  jc?
17:17:21 <weiler> jeffh: 427 after 464.  427 largely done.  jyasskin noticed some stuff that needs attn.
17:18:40 <weiler> topic: https://github.com/w3c/webauthn/pull/442
17:18:52 <weiler> nadalin: this is rolf's....
17:18:56 <weiler> zakim, who's here?
17:18:56 <Zakim> Present: weiler, wseltzer, jyasskin, selfissued_, nadalin, KetanMehta, jcj_moz, AkshayKumar, jeffh, alexei, alexei-goog, gmandyam
17:18:58 <Zakim> On IRC I see gmandyam, alexei-goog, jeffh, Ketan, Rolf, selfissued_, Zakim, RRSAgent, weiler, dmitriz, battre, mkwst, adrianba, jyasskin, wseltzer, jcj_moz, trackbot, schuki,
17:18:58 <Zakim> ... jochen___, slightlyoff
17:19:06 <weiler> present+ Rolf
17:19:17 <weiler> present- alexei
17:19:54 <weiler> jyasskin: this needs more specification.  need to be spelled out more - acronyms not great for readability.
17:20:37 <weiler> ... by pulling in two more selection criteria, it starts interacting w/ user verification changes.  may want to pull extra bits into user verification.  at least make sure all is aligned.
17:21:05 <weiler> .... this ties into 460.
17:21:34 <weiler> .... @@ says this ties into biometric auth.
17:21:48 <weiler> jeffh: 442/460 are linked.
17:22:31 <weiler> giri: should we assume that @2 need to be separate PRs?
17:23:06 <weiler> selfissued: should be able to evaluate these independently.  each proposed selection criteria should be written up separately
17:23:16 <weiler> ... so it's not an "all or none" decision to take them.
17:23:38 <weiler> jeffh: +1
17:24:09 <weiler> nadalin: who will split functionality of options out?  (460)
17:24:40 <weiler> @3: not 460, but 442.
17:26:19 <weiler> [see: https://github.com/w3c/webauthn/pull/442#issuecomment-303794031
17:26:19 <weiler> ]
17:26:51 <weiler> giri: don't get too hung up on Q4.... merge the PR, fix normative processing reqs for UA.
17:27:14 <weiler> jyasskin: hard to understand selection criteria w/o a sketch of the process rules/algorithm.
17:27:53 <weiler> giri: agree, but alg. doesn't need to be final to merge the PR.  in favor if merging AAGUID criteria w/ understanding that once user verficiation is merged, need to look at alg in totoal
17:28:14 <weiler> jyasskin: 442 has no alg for aaguid; needs something even if imperfect.
17:28:19 <weiler> giri: ok
17:28:37 <weiler> alexei: can we go back to 460?
17:28:50 <weiler> topic: https://github.com/w3c/webauthn/pull/460
17:29:04 <weiler> alexei: can objectors please explain themselves?
17:29:34 <weiler> jyasskin: just doing user verification doesn't guarantee same suer created/using cred.
17:29:46 <weiler> ... needs to be passed to authenticator.  need to say was authenticator does w/ it.
17:30:09 <weiler> alexei: I keep forgetting that we're specifying authenticator behavior here in the web spec.
17:30:22 <weiler> ... I'll clarify authenticator behavior.
17:30:59 <weiler> selfissued: desc of alg @5 is wrong.  assumes authenticator can do this, but client doesn't have this knowledge.
17:31:13 <weiler> ... may need to send req through to authenticator and see what happens.
17:31:38 <weiler> alexei: client needs to call getinfo whenever authenticator shows up
17:31:47 <weiler> selfissued: specs don't say that
17:32:03 <weiler> alexei: implementation issue.  need to figure out how to get that into the specs
17:32:22 <weiler> jeffh: i would characterize this as an implementation consideration.  advice to implementor.
17:32:43 <weiler> alexei: we're writing pseudocode in the spec ....  if we're gonna do that, I'll just add this.
17:33:08 <weiler> selfissued: we do want this functionality.  just that right now we're making assumptions
17:33:27 <weiler> rrsagent, draft minutes
17:33:27 <RRSAgent> I have made the request to generate http://www.w3.org/2017/05/24-webauthn-minutes.html weiler
17:33:49 <weiler> topic: https://github.com/w3c/webauthn/pull/470
17:34:09 <weiler> selfissued: I took action item.  other things have been higher priority.  i'll write a PR
17:34:20 <weiler> chair: nadalin
17:34:43 <weiler> topic: wd-06 issues
17:35:40 <weiler> https://github.com/w3c/webauthn/issues/466 is the first we haven't covered - opened 5 days ago.
17:36:08 <weiler> https://github.com/w3c/webauthn/issues?page=1&q=is%3Aopen+is%3Aissue+milestone%3AWD-06
17:36:43 <weiler> topic: https://github.com/w3c/webauthn/issues/416
17:36:47 <weiler> rpID seems to have changed meaning a bit
17:37:00 <weiler> jeffh: will be closed by PR464
17:37:29 <weiler> nadalin: origins stuff from last week: 259/255 will get wrapped up in that.  and 260
17:38:06 <weiler> jeffh: 167 just goes away.  confirm from jyasskin/mike west / @6?
17:38:32 <weiler> issue 393: rename "attestation data" to be "attested credential"
17:38:50 <weiler> jehhf: re: issue 393: we should do that.... just needs to be cranked out.
17:41:06 <Rolf> Talking about issue #283
17:41:12 <Rolf> Not assigned to anyone yet.
17:41:17 <jcj_moz> scribenick: Rolf
17:41:47 <Rolf> according to JeffH: that one can wait
17:42:10 <Rolf> Now on 285: Will that one be picked up after credman merge?
17:42:48 <Rolf> Assigned to JeffH+jyasskin
17:43:44 <Rolf> jyasskin has identified 4 items -- simple editing change to be done
17:44:37 <Rolf> Now 292:
17:45:16 <Rolf> might be related to Issue 316 (cancel operation)
17:45:51 <Rolf> lower priority?
17:46:16 <Rolf> 326 is fixed
17:47:16 <Rolf> by PR 464
17:48:21 <Rolf> Now 329
17:49:08 <Rolf> Only 2 items left: attachment+transport
17:49:49 <Rolf> Seems simple to do.
17:50:24 <Rolf> Now 351:
17:51:06 <Rolf> Simple do it as proposed in the comments of that issue
17:51:37 <Rolf> Now 362:
17:52:25 <Rolf> More complicated.
17:52:34 <Rolf> Needs more thinking
17:53:05 <Rolf> 392 already discussed. Now 393:
17:53:31 <Rolf> Simple - just do it.
17:53:36 <Rolf> Now 414:
17:54:13 <Rolf> JeffH is working on it
17:54:28 <weiler> zakim, who's here?
17:54:28 <Zakim> Present: weiler, wseltzer, jyasskin, selfissued_, nadalin, KetanMehta, jcj_moz, AkshayKumar, jeffh, alexei-goog, gmandyam, Rolf
17:54:30 <Zakim> On IRC I see gmandyam, alexei-goog, jeffh, Ketan, Rolf, selfissued_, Zakim, RRSAgent, weiler, dmitriz, battre, mkwst, adrianba, jyasskin, wseltzer, jcj_moz, trackbot, schuki,
17:54:30 <Zakim> ... jochen___, slightlyoff
17:54:34 <weiler> present+ dirk
17:55:05 <Rolf> Now 416:
17:55:15 <Rolf> Will be fixed by PR 464
17:55:22 <weiler> rrsagent, draft minutes.
17:55:22 <RRSAgent> I'm logging. I don't understand 'draft minutes.', weiler.  Try /msg RRSAgent help
17:55:23 <weiler> rrsagent, draft minutes
17:55:23 <RRSAgent> I have made the request to generate http://www.w3.org/2017/05/24-webauthn-minutes.html weiler
17:55:26 <Rolf> Now 462: undefined terms
17:56:26 <Rolf> relevant for milestone: CR.
17:56:41 <Rolf> Simple, but work to add defs
17:56:45 <Rolf> Now: 466
17:57:28 <Rolf> MikeJ working on that.
17:57:45 <Rolf> rp.id already present.
17:57:53 <Rolf> So: just do it.
17:57:55 <Rolf> Now 467:
17:59:34 <Rolf> proposal exists. Please review.
18:00:25 <Rolf> Now 471:
18:01:09 <Rolf> Now 472:
18:02:02 <Rolf> Optimization to reduce number of bytes if only a single item is relevant
18:02:22 <Rolf> thank you - go for it
18:02:25 <weiler> scribenick: weiler
18:02:33 <weiler> 474:
18:02:49 <weiler> jeffh: need yjasskin, jcj's input.
18:03:03 <weiler> selfissued: does not allowing host #'s make it harder to test?
18:03:32 <weiler> jeffh:  dunno.  w/ HSTS, we disallowed all but domain names.  HTTP strict transport security.  policy to say "only-TLS".
18:04:01 <weiler> jcj: ... not a big deal to not be using port numbers.
18:04:14 <weiler> jeffH; not only no ports; also no IP addrs.
18:04:36 <weiler> nadalin: adjourned
18:04:43 <weiler> rrsagent, draft minutes
18:04:43 <RRSAgent> I have made the request to generate http://www.w3.org/2017/05/24-webauthn-minutes.html weiler
18:47:59 <weiler> weiler has joined #webauthn
19:57:49 <Zakim> Zakim has left #webauthn