15:53:07 <RRSAgent> RRSAgent has joined #wpwg-spc
15:53:07 <RRSAgent> logging to https://www.w3.org/2021/05/03-wpwg-spc-irc
15:53:18 <Ian> Meeting: SPC Task Force
15:53:20 <Ian> Chair: Ian
15:53:34 <Ian> Agenda: https://lists.w3.org/Archives/Public/public-payments-wg/2021Apr/0012.html
15:53:36 <Ian> Scribe: Ian
15:53:57 <Ian> agenda+ Origin trial end date
15:54:04 <Ian> agenda+ User stores
15:54:07 <Ian> agenda- User stores
15:54:09 <Ian> agenda+ User stories
15:54:14 <Ian> agenda+ Issue 56
15:54:15 <Ian> agenda+ Issue 57
15:54:19 <Ian> agenda+ Regular meeting time
15:54:24 <Ian> regrets+ Tomasz
15:54:39 <Ian> regrets+Anne_Pouillard
15:54:46 <Ian> regrets?
15:54:54 <Ian> regrets+ Anne_Pouillard
15:55:24 <mweksler> mweksler has joined #wpwg-spc
15:58:21 <Clinton> Clinton has joined #wpwg-spc
15:59:27 <Ian> present+
15:59:31 <Ian> present+ Clinton_Allen
15:59:37 <Ian> present+ Michel_Weksler
16:00:40 <Ian> present+ Jean-Carlo_Emer
16:00:50 <Ian> present+ Stephen_McGruer
16:01:14 <Ian> present+ Gustavo_Kok
16:01:53 <Ian> present+ Gerhard_OOsthuizen
16:02:06 <Ian> present+ Jeff_Hodges
16:02:30 <Ian> present+ Amy_Slack
16:02:33 <Ian> present+ Doug_Fisher
16:02:39 <Ian> present+ Christian_Aabye
16:02:55 <Ian> present+ Werner_Bruinings
16:03:20 <Ian> -> https://lists.w3.org/Archives/Public/public-payments-wg/2021Apr/0012.html Agenda
16:03:22 <Ian> agenda?
16:03:40 <Ian> zakim, take up item 1
16:03:40 <Zakim> agendum 1 -- Origin trial end date -- taken up [from Ian]
16:04:16 <jeffh> jeffh has joined #wpwg-spc
16:04:17 <Ian> Mweksler: Airbnb and Adyen are going to do a pilot with SPC. Want to do this as part of the origin trial, and to see if we have any flexibility on the end date.
16:04:54 <Ian> Stephen: The origin trial is from 91-93. I think this is through mid-September
16:05:03 <Ian> ...we extend origin trials for 2 reasons
16:05:11 <Ian> ...if there's a browser bug (invalidating the origin trial)
16:05:20 <Ian> ...more commonly, when partners need more time!
16:05:29 <Ian> present+ Sameer_Tare
16:05:40 <Ian> ...sometimes we can extend 1 or more release cycles
16:05:48 <SameerT> SameerT has joined #wpwg-spc
16:06:02 <Ian> mweksler: It would be great to chat with you more about the pilot idea
16:06:09 <Ian> present+ Praveena_Subrahmany
16:06:28 <Ian> mweksler: When would we need to request the extension and to whom?
16:06:33 <Ian> Stephen: File the request with me
16:06:41 <Ian> ...how about by July?
16:06:46 <wernerb_> wernerb_ has joined #wpwg-spc
16:06:48 <Ian> present+ Adrian_Hope-Bailie
16:07:11 <Ian> michel: Noted!
16:07:17 <Ian> zakim, close item 1
16:07:17 <Zakim> agendum 1, Origin trial end date, closed
16:07:18 <Zakim> I see 5 items remaining on the agenda; the next one is
16:07:18 <Zakim> 2. User stores [from Ian]
16:07:25 <Ian> zakim, close item 2
16:07:25 <Zakim> agendum 2, User stores, closed
16:07:26 <Zakim> I see 4 items remaining on the agenda; the next one is
16:07:26 <Zakim> 3. User stories [from Ian]
16:07:28 <Ian> zakim, take up item 3
16:07:28 <Zakim> agendum 3 -- User stories -- taken up [from Ian]
16:07:36 <Ian> https://github.com/w3c/secure-payment-confirmation/blob/gh-pages/scope.md
16:07:45 <praveena> praveena has joined #wpwg-spc
16:07:47 <jeffh_> jeffh_ has joined #wpwg-spc
16:07:54 <AdrianHB> agenda?
16:08:00 <Ian> https://github.com/w3c/secure-payment-confirmation/pull/60
16:08:18 <Ian> https://github.com/w3c/secure-payment-confirmation/pull/60/files
16:09:18 <Ian> 1) Out of band enrollment
16:09:35 <Ian> Stephen: +1 to this use case. Captures the important of "enrolling all your payment instruments"
16:10:01 <Jean_Emer_> Jean_Emer_ has joined #wpwg-spc
16:10:50 <Gerhard_> Gerhard_ has joined #wpwg-spc
16:10:51 <Ian> 2) In-transaction enrollment, authentication same merchant
16:10:54 <gkok> gkok has joined #wpwg-spc
16:11:19 <Ian> 3) Authentication different merchant
16:11:58 <Ian> 4) Enrollment for both payment authentication and account login
16:12:36 <Ian> mweksler: The details are for discussion but the general idea is to do one-step login plus payment authentication
16:13:08 <Ian> ...it would be great if, during a guest checkout, the user pays and the merchant can use the authentication step both for payment and to create an account
16:13:17 <Gerhard_> q+
16:13:27 <Ian> ack Gerhard_
16:13:49 <smcgruer_[EST]> q+
16:14:01 <Ian> Gerhard_: When I look at this use case from a banking perspective, we definitely see the use case.
16:14:38 <Ian> ...are you thinking about this from banking or merchant perspective?
16:14:53 <Ian> mweksler: Merchant perspective. Want to use credentials for future login
16:15:53 <Ian> ...user perspective is "just authenticate once; allow multiple usage"
16:16:42 <Ian> stephen: In the use case it talks about using this credential on a "different" merchant.
16:16:42 <Gerhard_> Just note Michel: This sounds more like Delegated Auth use-cases.
16:17:11 <Ian> michel: I was not thinking about cross-merchant login
16:18:28 <Ian> Ian: My understanding was that the issuer is the RP, and gives the merchant the info required to re-use the credential for login
16:18:34 <smcgruer_[EST]> q+
16:18:55 <Ian> Ian: But that login use case breaks web auth same origin policy, so would need to handle specially
16:19:06 <SameerT> +1 to what Gerhard mentioned, owner (RP) of the credentials will drive use-cases differently
16:19:07 <Ian> ack sm
16:19:45 <Ian> smcgruer_[EST]: Sharing creds is a FIDO problem, not an SPC problem
16:20:17 <Ian> 5) Lower Friction
16:20:50 <Ian> (Brought to us by Entersekt)
16:20:54 <Ian> https://github.com/w3c/secure-payment-confirmation/pull/60/files
16:22:08 <Ian> Gerhard: Low friction to me is "transaction display but just "verify" button"
16:22:16 <Ian> ..you still get cryptographic signature
16:22:32 <Ian> ...this is not a frictionless flow (e.g., based on previous consent by the user)
16:23:14 <Ian> ...if there is a frictionless flow, then the signed data would need to say so
16:24:38 <Christian> Christian has joined #wpwg-spc
16:25:18 <Ian> Ian: I think we've been talking about 3 levels:
16:25:26 <Ian> 1) display and user verification
16:25:36 <Ian> ..there is a multi-factor event
16:25:41 <Ian> 2) display and user presence
16:25:49 <Ian> 3) display and possession, but no user presence check
16:26:06 <Ian> 4) no display and no user presence check
16:26:10 <Ian> (but previous consent)
16:26:14 <Ian> q?
16:27:17 <Ian> JeffH: Silent authentication is not supported in WebAuthn but technically can be done at CTAP layer
16:28:34 <Ian> ..authenticators might have displays
16:28:54 <mweksler> q+
16:29:09 <Ian> ...authenticators that are discrete components that have display in the authenticator boundary are rare.
16:29:14 <Ian> ack mw
16:29:45 <Ian> mweksler: I suggest that if we feel like the use case is useful, we can still add it
16:30:14 <Ian> ...as a merchant, this is very useful (with user consent) to do something with silent authentication
16:30:22 <Ian> ...but we don't want to create a security hole
16:31:15 <Ian> ACTION: To split these use cases into the 4 experiences we described here.
16:32:07 <Ian> zakim, take up item 6
16:32:07 <Zakim> agendum 6 -- Regular meeting time -- taken up [from Ian]
16:32:11 <Gerhard_> +1 for moving to WPWG group
16:32:19 <mweksler> +1 to move to an hour, -1 to 7 am pacific
16:32:21 <Ian> PROPOSED: Move this 30 mins to 1 hour every other week on thursday call
16:32:44 <Ian> Christian: We (EMVCo) have a conflict then
16:33:29 <Ian> Next meeting: 10 May
16:33:30 <Doug> Doug has joined #wpwg-spc
16:33:50 <Ian> RRSAGENT, make minutes
16:33:50 <RRSAgent> I have made the request to generate https://www.w3.org/2021/05/03-wpwg-spc-minutes.html Ian
16:33:55 <Ian> rrsagent, set logs public
16:34:15 <Ian> rrsagent, bye
16:34:15 <RRSAgent> I see 1 open action item saved in https://www.w3.org/2021/05/03-wpwg-spc-actions.rdf :
16:34:15 <RRSAgent> ACTION: To split these use cases into the 4 experiences we described here. [1]
16:34:15 <RRSAgent>   recorded in https://www.w3.org/2021/05/03-wpwg-spc-irc#T16-31-15
16:34:17 <Ian> zakim, bye
16:34:17 <Zakim> leaving.  As of this point the attendees have been Ian, Clinton_Allen, Michel_Weksler, Jean-Carlo_Emer, Stephen_McGruer, Gustavo_Kok, Gerhard_OOsthuizen, Jeff_Hodges, Amy_Slack,
16:34:17 <Zakim> Zakim has left #wpwg-spc