01:42:44 <RRSAgent> RRSAgent has joined #telecom-authn
01:42:44 <RRSAgent> logging to https://www.w3.org/2019/09/18-telecom-authn-irc
01:42:47 <dom> RRSAgent, make log public
01:47:16 <dom> Meeting: Authentication by Communication Network
01:50:53 <koalie> koalie has joined #telecom-authn
01:51:05 <koalie> RRSAgent, make logs public
01:51:09 <koalie> koalie has changed the topic to: https://w3c.github.io/tpac-breakouts/sessions.html
01:51:12 <koalie> koalie has left #telecom-authn
01:54:28 <weiler> weiler has joined #telecom-authn
01:54:44 <Zakim> Zakim has joined #telecom-authn
01:55:02 <Chunming> Chunming has joined #telecom-authn
01:56:11 <Chunming> Meeting: Authentication by Communication Network
01:56:40 <weiler> present+
01:56:57 <nmooney> nmooney has joined #telecom-authn
01:57:00 <Chunming> present+
01:57:22 <dom> dom has joined #telecom-authn
01:57:28 <disoul> disoul has joined #telecom-authn
01:57:33 <yuyin> yuyin has joined #telecom-authn
01:57:51 <cwarnier> cwarnier has joined #telecom-authn
01:59:16 <Chunming> [Summary: Summary:
01:59:16 <Chunming> Introduce what Telecom Authentication is, and introduce the security risks and solutions of Telecom Authentication, especially when using WEB, instead of client, to authenticate.]
01:59:30 <Chunming> https://w3c.github.io/tpac-breakouts/sessions.html#telecom-authn
02:00:43 <Chunming> Jiaqiang: Introduce myself, I am from security team of Chinamobile, with my college chenjun
02:00:47 <weiler> jIa: I'm from the China Mobile security team.
02:00:55 <Chunming> ... we come from operators
02:01:22 <Chunming> ... [slide 1]
02:01:45 <weiler> [slide: background: "mobile number is userID in most APPs"]
02:01:57 <Chunming> ... telcom authentication: the mobile phone number is the userID in most APPs in china.
02:02:58 <lilin> lilin has joined #telecom-authn
02:03:15 <hyojin> hyojin has joined #telecom-authn
02:03:17 <xfq> xfq has joined #telecom-authn
02:03:20 <weiler> Gerhard:  phone is not used for login, but when strong auth - 2FA - is needed, phone number is used as "thing you have", so this will let us get rid of SMS-OTP and prevent SIM-swap fraud.
02:03:25 <weiler> ... interested to see a std soln.  this is still useful.
02:04:10 <xueyuan> xueyuan has joined #telecom-authn
02:04:16 <weiler> [slide: problem solved: hard user acquisition caused by complex registration, 2) mgmt burden from multiple mlogin methods 3) security risks of pw dilvuge]
02:04:44 <Chunming> Jiaqiang: we want to delivery the "one-click-login"
02:05:05 <Chunming> ... [slide 2: Process of Telecom Authetication]
02:05:43 <dsinger> dsinger has joined #telecom-authn
02:05:48 <weiler> [there's a pre-comm phase between app and erver to decide if telecom-authn is available or not]
02:06:02 <xueyuan> s/delivery/deliver
02:06:39 <Chunming> ... pre-authentication phase: to pre-estimate whether this user could use telecom-authn or not, via a pre-authn logic
02:06:44 <ryosuke1224> ryosuke1224 has joined #telecom-authn
02:07:16 <Chunming> ... authentication phase: to formally launch the authentication and retrieve the token, with interaction with user.
02:07:33 <Chunming> ... login phase: to login with token
02:07:50 <Chunming> ... [slide 3: Scenario 1 - Auto Login]
02:08:13 <Chunming> ... the apps ascuiremobile phone numbers by communication network
02:08:19 <Chunming> ... then use the phone numbers to login
02:08:34 <Chunming> ... right now, we provide SDK to support this feature
02:08:54 <Chunming> ... it is faster, login within 3 seconds
02:09:12 <Chunming> ... it is safer, than password and login with short messages(SMS)
02:09:54 <Chunming> ... more efficient, in this scenario, you do not do the seperate registration anymore, login is integrated with registration.
02:10:27 <yuki-uchida> yuki-uchida has joined #telecom-authn
02:10:45 <Chunming> @@2: will this provide more registration information?
02:11:24 <Chunming> Jiaqiang: No. only provide mobile number in lightweight user scenario.
02:11:44 <Chunming> Sam: if the user change the operator, the history will get lost.
02:11:47 <jeff> jeff has joined #telecom-authn
02:11:56 <Chunming> Jiaqiang: (continue)
02:12:07 <Steven-Google> Steven-Google has joined #telecom-authn
02:12:08 <Chunming> ... Scenario 2, phone number checking
02:12:09 <wseltzer> wseltzer has joined #telecom-authn
02:12:37 <weiler> jiaqiang: we're workong on number protability
02:12:42 <Chunming> ... [slide 5: application status]
02:12:49 <weiler> sam: absent norber portability, this is just more user lock-in.  this is user-hostile!
02:12:58 <xueyuan> zakim, make minutes
02:12:58 <Zakim> I don't understand 'make minutes', xueyuan
02:13:03 <Chunming> ... by may 2019, average active users 210 millions per day
02:13:11 <weiler> [slide: 1.16B auths/day, 210M users/day, 2600+ apps]
02:13:13 <Chunming> ... it is widely used
02:13:22 <xueyuan> rrsagent, make minutes
02:13:22 <RRSAgent> I have made the request to generate https://www.w3.org/2019/09/18-telecom-authn-minutes.html xueyuan
02:13:32 <xfq> s/protability/portability/
02:13:36 <Chunming> ... [slide: security concerns]
02:13:46 <xueyuan> s/zakim, make minutes//
02:13:46 <Chunming> ... aspect 1: XSS attack risks
02:14:01 <Chunming> ... attackers could put malicious code in website
02:14:16 <Chunming> ... the target server may return token to user
02:14:27 <Chunming> ... aspect 2: mobile hotspot security rishs
02:14:33 <Chunming> s/rishs/risks/
02:14:34 <xueyuan> rrsagent, make log public
02:14:47 <Chunming> ... in mobile hotspot cases, the token of hotspot sponsor might be leaked
02:15:11 <Chunming> ... [slide: solutions]
02:15:25 <Chunming> ... all these risks has been solved by our SDK ways now
02:15:44 <Chunming> ... SDK testifies the app id and sim card info, thus the attacker can no longer fake the user to login
02:15:59 <Chunming> ... [slide: expectations of web standardization]
02:16:14 <Chunming> ... we propose to promote a wider acceptance of telecom authentication
02:16:25 <Chunming> ... and apply the telecom authentication to the browser/server applications
02:16:41 <Chunming> ... we hope to make the telecom authn standardized in W3C
02:16:42 <jbarclay> jbarclay has joined #telecom-authn
02:16:47 <Chunming> ... to help solve the problem i just mentioned
02:16:55 <xfq> q?
02:16:56 <Chunming> q?
02:17:14 <tung_> tung_ has joined #telecom-authn
02:17:17 <tung_> tung_ has left #telecom-authn
02:17:21 <tung_> tung_ has joined #telecom-authn
02:17:46 <jbarclay> present+ James_Barclay
02:17:55 <tung_> tung_ has left #telecom-authn
02:17:58 <weiler> gerhard: are sim-swap attacks - which are often used - have you seen those?
02:18:02 <dsinger> q+ to ask how the service and operator interact to get the phone number and verify it’s authorized for this service
02:18:23 <weiler> jia: have not seen this.  can't logout.
02:18:54 <Chunming> q?
02:19:28 <Chunming> Sam: if i lsot my phone, i will request a new simcard from vendor
02:19:45 <xueyuan> s/lsot/lost
02:19:50 <Chunming> s/lsot/lost/
02:20:12 <weiler> q+
02:23:59 <nmooney> q+
02:25:03 <weiler> gherardt: we have a N-hour sim-swap lockout - we won't allow access if sim has been swapped in an interval
02:25:09 <weiler> ack ds
02:25:09 <Zakim> dsinger, you wanted to ask how the service and operator interact to get the phone number and verify it’s authorized for this service
02:25:30 <Chunming> q?
02:25:32 <jeffh> jeffh has joined #telecom-authn
02:25:40 <Jv_> Jv_ has joined #telecom-authn
02:25:50 <jeffh> q?
02:25:56 <weiler> q+ jeffh
02:25:59 <dsinger> present+ david_singer
02:26:01 <jeffh> q+
02:26:07 <weiler> ack me
02:26:39 <dsinger> q+ to talk about authorization and identification
02:26:40 <Jv_> q+ relating this to payment request api
02:26:54 <dontcallmeDOM> dontcallmeDOM has joined #telecom-authn
02:27:04 <Chunming> Sam: what is the information exchanged during the Pre-authentication phase (phase 1-3)
02:27:34 <weiler> jia: [not much detail]
02:27:38 <Jv_> q+ to talk about payment request api and this
02:28:04 <Chunming> q?
02:28:37 <weiler> sam: how detailed of a spec do you?
02:28:41 <weiler> s/you/you have/
02:28:46 <weiler> jia: very detailed.
02:30:17 <weiler> gherardt: important problem
02:30:31 <weiler> @3: used for login, not payment
02:31:05 <dsinger> q?
02:31:07 <weiler> gherardt: trend is to use both something you have and something you know.  this helps with the former
02:31:17 <weiler> @3: this does not replace PW; this is for login.  - replacing SMS code for login.
02:31:23 <weiler> ack nm
02:31:42 <weiler> nick: people bristling at using this as primary auth.  this flow is something we commonly do.
02:32:20 <weiler> ... CEO of twitter just had a sim-swap attack hit him.  I'm curious re: attestation of SIM card - not just phone number.
02:32:38 <weiler> ... could this sign a claim of "here's the last time this SIM was swapped"?
02:32:54 <ymatsuura> ymatsuura has joined #telecom-authn
02:32:54 <weiler> jia: repeating: besides phone number, any other identifies?
02:33:08 <weiler> nick: any more info that can be attested to?  more info might be useful.
02:33:17 <weiler> gerhardt: non-PII.
02:33:23 <weiler> ... e.g. IMSI hash
02:33:35 <weiler> sam: hash is still linkable
02:33:43 <weiler> .. linkable is still an issue
02:33:47 <xueyuan_> xueyuan_ has joined #telecom-authn
02:33:54 <weiler> nick: I'd claim linkability isn't an issue w/ the spec.
02:34:08 <weiler> ... We will have to use phone numbers to solve some problems.
02:34:18 <weiler> q?
02:34:19 <nmooney> ack me
02:34:41 <weiler> jia: maybe we could build a mechanism ... let user know IMSI number connected to other accounts.
02:35:08 <weiler> ack jeff
02:35:29 <weiler> jeffh: GSMA Mobile Connect - are you aware of it?
02:35:44 <weiler> jia: not aware of it.  but engaged with GSMA.
02:36:07 <weiler> jeffh: GSMA Mobile Connect seems similar.
02:36:38 <weiler> ... verification of user is possession of phone, right?
02:36:39 <Chunming> GSMA Mobile Connect: https://www.gsma.com/identity/mobile-connect
02:36:41 <weiler> jia: yes.
02:36:51 <weiler> jeffh: what if my lock screen is turned off?
02:36:58 <weiler> jia: very dangerous.
02:37:26 <weiler> ... use this for low-value situations.
02:37:51 <weiler> jeffh: so you do step-up auth.
02:37:51 <Chunming> q?
02:37:51 <weiler> q?
02:38:20 <weiler> ... if you wanted to attack the pw problem - which isn't doesn't sound like you're doing, since you're still using PWs in other contexts.
02:38:39 <weiler> ack dsin
02:38:39 <Zakim> dsinger, you wanted to talk about authorization and identification
02:39:07 <weiler> dsinger: you're replacing a PW - proof of authorization - with identity, which is bad for privacy
02:39:29 <weiler> nick: important to separate technical means of assocaiting user with number and .... still ahve to solve that problem sometimes.
02:39:42 <weiler> dsinger: you're encouraging a lot of service to identify users.  that is the problem
02:40:17 <weiler> gerhardt: I see this angle.  looking at EU stds... there must ahve been an intial registration to get phone number.
02:40:32 <weiler> ... this is to confrim ownership  of number already linked
02:40:35 <weiler> sam: not what I heard
02:41:14 <weiler> dsinger: if I wanted a BB acount - could create an anon acct w/ PW.  they don't know it's dsinger, just someone w/ an account.  if they move to this, they know the phone number and all accoutns everywhere associated.
02:41:30 <weiler> q?
02:41:42 <Chunming> s/ahve been/have been/
02:41:46 <weiler> gerhardt: I'm thinking from lens of a finacial instituion w/ KYC requiremetns
02:41:50 <weiler> ack JV
02:41:50 <Zakim> Jv_, you wanted to talk about payment request api and this
02:42:38 <weiler> @4: universal authen.  probably don't need to associate access rights w/ ID.  but as extension for imission-critical apps, people dont' want to create new acct.
02:43:07 <weiler> ... they're going to provide identity anyway, this is ok.  for other scenarios - social networks - you have some other options.  they are trying to provide a new option for mission cirital apps.
02:43:18 <weiler> dsinger: @7
02:43:38 <weiler> jia: please look at animation again.
02:43:54 <weiler> talk about payment request api and this
02:44:09 <weiler> s/talk about payment request api and this//
02:44:11 <lilin> Mobile Connect Platforms and Operations services, mobile connnect SDK, https://www.gsma.com/identity/wp-content/uploads/2019/03/mc_mwc_platforms_booklet2_web_02_19-1.pdf
02:44:12 <weiler> q+ jv to talk about payment request api and this
02:44:18 <weiler> ack jv
02:44:18 <Zakim> jv, you wanted to talk about payment request api and this
02:44:32 <dsinger> there are probably ways to set it up such that the service and the MNO set up service-specific identifiers, such that the service is NOT given the phone-number, but something that can’t be correlated with a specific person and their uses of other services.
02:45:05 <weiler> jv: webpayments WG, payment req API; this is useful: get phone umber - send to bank - they send a code - web browser can pick it up....
02:45:25 <Chunming> s/phone umber/phone number/
02:45:30 <weiler> gerhardt: I'd go past this - if you can passively verify - bank has phone # - can we in background attest to it - pass token to bank to validate token - don't need sms
02:45:49 <weiler> ... use this in a assive way w/o user involvement.
02:45:50 <weiler> q+
02:46:05 <weiler> ... bank can say I expect this from this number, is it from there?
02:46:26 <weiler> dsinger: @8
02:46:38 <weiler> jv: big problem in payment request is how to auth user in few steps.
02:47:21 <weiler> ack me
02:48:09 <Chunming> q?
02:48:11 <weiler> me: this is intertwining identity ... you might need only to AUTHORIZE a user, not identify them
02:48:15 <weiler> s/me/sam/
02:48:30 <weiler> sam: why does this take 3 secs?
02:48:30 <sss> sss has joined #telecom-authn
02:48:36 <weiler> ... that seems slow.
02:48:42 <weiler> jia: haven't heard that Q before.
02:48:55 <weiler> ... my colleague says 1 sec.
02:50:46 <Chunming> sam: security concern aspect 2, how do you avoid sending to the wrong party
02:51:31 <weiler> jia: we switch to mobile network?
02:51:33 <Chunming> ... are we trusting the whole network?
02:51:54 <Chunming> q+
02:56:09 <weiler> gerhardt: to nick's point, this is a real point that we want to solve... having a way to attest to a phone number.. browser agent has the ability to swap to LTE/3G not just 802.11.   has ability to make call to mobile network operatro.  many orgs around this world will want to o this.  right aporach: not sure.   but worthwhile for w3c to explore solving.  this is a tough problem to solve.  solving it in a goodway.
02:56:15 <weiler> ... is good for the net.
02:56:15 <JUN> JUN has joined #telecom-authn
02:56:26 <dsinger> q+ to comment on the problem
02:56:36 <weiler> JV: would have to be in collaboration w/ GSMA.  in payments, working w/ fida and emvco.  gsma has a role to pay.
02:57:24 <weiler> dsinger; I'm coming across as negative, but I'm more negative about PWs.
02:57:35 <weiler> ... not sure w3c should be doing mobile.
02:58:05 <dsinger> s/mobile/a solution that is specific to (only) mobile/
02:58:05 <weiler> gerhardt: US has new protocol to prevent spam/robot calls.  maybe shaken/stir fits in?
02:58:09 <weiler> ack ch
02:58:12 <dsinger> q-
02:58:30 <weiler> chunming: if we have many fixes to soln, how to we integrate this into webauthn framework?
02:58:54 <weiler> gerhardt: web authn tests for the person - that there is a person present.  and that a biometric cred is presented
02:59:45 <weiler> sam: disagree with you again.  Webauthn is more about user.
03:00:05 <weiler> s/user/device/
03:01:38 <weiler> jia: maybe youre device and PW are not safe... cannot say PW must be safer than device - both PW and device are auth
03:03:21 <weiler> sam: how does this compare to building a webauthn device into aphone?
03:03:44 <weiler> gerhardt: we have this more for registration - not the day-to-day auth.  want number at start, for registry.
03:04:51 <xueyuan> Rrsagent, make minutes
03:04:51 <RRSAgent> I have made the request to generate https://www.w3.org/2019/09/18-telecom-authn-minutes.html xueyuan
03:35:06 <dsinger> dsinger has joined #telecom-authn
04:15:21 <nmooney> nmooney has joined #telecom-authn
04:21:11 <dsinger> dsinger has joined #telecom-authn
04:29:39 <dontcallmeDOM> dontcallmeDOM has joined #telecom-authn
04:30:14 <dsinger> dsinger has joined #telecom-authn
04:32:56 <dsinger> dsinger has left #telecom-authn
04:33:42 <Chunming> Chunming has joined #telecom-authn
04:36:36 <nmooney> nmooney has left #telecom-authn
04:39:18 <xfq> xfq has joined #telecom-authn
04:39:33 <xfq> xfq has left #telecom-authn
04:44:14 <dom> dom has left #telecom-authn
05:22:15 <Zakim> Zakim has left #telecom-authn
07:12:18 <Chunming> Chunming has joined #telecom-authn
07:52:00 <jbarclay> jbarclay has joined #telecom-authn
07:53:31 <jbarclay> jbarclay has joined #telecom-authn
08:00:46 <Chunming> Chunming has joined #telecom-authn
09:09:15 <Chunming> Chunming has joined #telecom-authn
09:24:32 <hyojin> hyojin has left #telecom-authn