13:56:54 RRSAgent has joined #wpwg 13:56:54 logging to https://www.w3.org/2021/11/04-wpwg-irc 13:57:01 Meeting: Web Payments Working Group 13:57:08 Agenda: https://github.com/w3c/webpayments/wiki/Agenda-20211004 13:57:13 Chair: AdrianHB 13:57:15 Scribe: Ian 13:57:19 Regrets+ NickTR 13:57:22 agenda+ Privacy Sandbox 13:57:28 agenda+ TPAC Recap 13:57:37 agenda+ Next meeting 13:57:44 I have made the request to generate https://www.w3.org/2021/11/04-wpwg-minutes.html Ian 13:58:31 present+ Ian_Jacobs 13:58:36 present+ Adrian_Hope-Bailie 13:59:23 Anne has joined #wpwg 13:59:45 present+ Anne_Pouillard 14:00:05 rouslan has joined #wpwg 14:00:11 present+ Rouslan 14:00:16 present+ Erhard_Brand 14:00:27 present+ Arno_van_der_Merwe 14:00:55 I have made the request to generate https://www.w3.org/2021/11/04-wpwg-minutes.html Ian 14:01:53 present+ Uno_Veski 14:02:01 Present+ Jean-Luc_di_Manno 14:02:11 Has the webex meeting started? If so, I'm in the wrong one :-D 14:02:36 present+ 14:02:40 present+ Robert_Savage 14:03:35 present+ Stephen_McGruer 14:04:34 present+ Gerhard+Oosthuizen 14:04:37 present+ Brian_Lefler 14:04:44 present+ Tomoya_Horiguchi 14:04:58 zakim, take up item 1 14:04:58 agendum 1 -- Privacy Sandbox -- taken up [from Ian] 14:05:28 -> http://www.w3.org/2021/Talks/rouslan-sandbox-20211028.pdf Rouslan Slides 14:06:30 zakim, make minutes 14:06:30 I don't understand 'make minutes', Ian 14:06:48 Rouslan: Privacy sandbox is undertaking project related to data collection. 14:07:34 ...default browser behavior will limit silent tracking 14:08:38 present+ 14:08:56 Gerhard has joined #wpwg 14:08:57 ...general concept is that if 2 sites have independent identities, then intended behavior is that correlation without user consent will not be possible 14:09:06 present+ Sam_Weiler 14:09:21 present+ Shyam_Sheth 14:10:24 rouslan: Chrome will phase out support for 3p cookies over a three-month period finishing in late 2023 14:11:28 ...cross-origin iframe will not have access to cookies 14:11:33 ...(by default) 14:11:50 ...the iframe can communicate with the top-level (who can tell the iframe who they think the user is). 14:12:12 ...if the user provides random identifier to top-level site, won't facilitate tracking via 3p 14:12:23 ...there are some other behaviors expected as well. 14:12:29 ...e.g., CHIPS 14:12:51 ...where the iframe can store SOME information, but CHIPS cookies will be scoped to the parent origin. 14:13:04 ...(storage partitioning) 14:13:38 ...cross-site information needs 1 user authentication in order to be able to store CHIPS cookies 14:13:49 q? 14:13:56 ...another project: "Fenced Frames" 14:14:04 q+ to ask what "authentication" means on the top-level site 14:14:12 ...this one blocks communication between the embedded iframe and the top level Web site 14:14:30 ...this proposal is very early in its life 14:14:46 ...but the idea is that tracking inhibited by lack of communication between origins 14:14:56 present+ Ryan_Watkins 14:15:20 rouslan: So how does all this affect payments? 14:15:31 [what's the expansion of CHIPS?] 14:15:43 q+ to ask for expansion of the CHIPS acronym 14:15:56 q+ 14:16:21 rouslan: Embedded code may have no idea who user is via regular iframe. This might mean, e.g., user retypes credit card each time they visit the same merchant 14:16:22 q? 14:16:37 rouslan: I think this will be a big change so we need to find alternatives to avoid breaking the web. 14:17:09 ...we need to hear from you what flows will break so we can find solutions 14:17:09 q? 14:17:37 jeanLuc has joined #wpwg 14:17:45 rouslan: We invite members of this Working Group to let us know your payments flows and how they would be broken by privacy sandbox changes 14:17:53 q+ to ask rouslan where we can document these flows that will break 14:17:55 ack AdrianHB 14:17:55 AdrianHB_, you wanted to ask what "authentication" means on the top-level site 14:18:15 AdrianHB: What does authentication look like to give an iframe access to CHIPS? 14:18:53 rouslan: That's my shorthand for "identifying yourself to the iframe". This might be, for example, providing an identifier for yourself. 14:19:16 AdrianHB: So you don't provide ID to the top-level iframe that is shared with cross-origin iframe? 14:19:38 Rouslan: You could do that, but if you provide a random identifier to the top-level identifier, you won't support tracking 14:20:21 AdrianHB: So I could identify myself as "user X" to cross-origin iframe and they could tell parent origin "This is user X". 14:20:39 Rouslan: Yes. But when code is embedded on a different origin, that information ("X") won't be available to them. 14:20:47 Weiler: What does CHIPS expand to? 14:21:01 Stephen: "Cookies Having Independent Partition State" 14:21:23 s/Partition/Partitioned 14:21:48 rouslan: Ideally you don't want to have to retype your card or bank account number on every site. 14:22:05 Adrian: If you use payment apps you still need to authenticate to the payment app. 14:22:22 rouslan: We don't want users to type username/password in an iframe. 14:22:35 q? 14:22:37 ack weiler 14:22:37 weiler, you wanted to ask for expansion of the CHIPS acronym 14:23:03 Rouslan: I need to find a better word than "authenticate" to mean "user provides identifying information" 14:23:06 ack Gerhard 14:24:24 Gerhard: Fenced frames sound more appealing to me. If I put a custom URL in a fenced iframe (e.g., in 3DS method URL). That's a channel of communication. 14:24:44 Rouslan: The fenced frame explainer discusses this. One thing they might do they call a "three states machine" 14:25:05 ...when the fenced frame accesses its URL from JavaScript it then loses storage access (write access) and network connectivity. 14:25:21 ...but I think this is an unanswered question in this early stage of the project 14:25:30 q? 14:25:36 Gerhard: I heard each iframe would have isolated storage. 14:26:01 q+ 14:26:09 Rouslan: Again, fenced frame behavior is not entirely known. 14:26:36 ...in this group we can help answer questions by describing what would break 14:26:55 I have made the request to generate https://www.w3.org/2021/11/04-wpwg-minutes.html Ian 14:27:23 Rouslan: I think we may need more than CHIPS and fenced frames for payments 14:28:14 Gerhard: How do these changes change: 14:28:17 a) hidden iframe 14:28:21 b) Secure storage in iframes 14:28:23 c) payment handlers 14:28:44 d) Popups 14:28:49 ...in an iframe 14:29:13 q? 14:29:22 rouslan: We don't know yet. What do you mean by secure storage? 14:29:36 Gerhard: Local storage / index DB 14:29:48 rouslan: I think the expectation is that all storage mechanisms would be partitioned 14:30:10 ...regarding payment handlers, they use service worker, and privacy sandbox expectation is partitioning there, too. 14:30:56 ack smcgruer_[EST] 14:31:21 smcgruer_[EST]: See the Federated Credential Management explainer -> https://github.com/WICG/FedCM/blob/main/explainer/problem.md 14:31:28 ...helpful in calling out problem statements 14:32:25 ...FedCM is evolving to a model where they are pretty sure their technology is privacy sensitive against all the changes that are envisioned 14:32:31 ...so that's a good example to be aware of 14:32:42 ack me 14:32:42 Ian, you wanted to ask rouslan where we can document these flows that will break 14:32:54 q+ 14:33:19 Gerhard: We know the 3DS flows; has that use case already been covered in privacy sandbox discussions? 14:33:48 q? 14:33:50 qq+ 14:33:59 Rouslan: We realize that 3DS will be affected. 14:34:00 +1 to the problem of general purpose features being abused. I still believe we can find a balance with PR API + PH API + SPC that is payment specific enough to prevent tracking exploits but generic enough to be widely useful 14:34:32 Gerhard: The EMVCo world view is that when data collection does not suffice, either accept risk or challenge 14:34:58 ...if we can get guidance on getting adequate consent that would be helpful. 14:35:11 ..are three clicks enough? a daily click? What suffices? 14:35:22 ..just tell me what the hoops are :) 14:35:26 ack sm 14:35:26 smcgruer_[EST], you wanted to react to Ian 14:37:00 ack smcgruer_[EST] 14:37:29 q? 14:37:30 smcgruer_[EST]: is this something we should pick up in the WG? 14:37:35 ack me 14:38:24 Ian: Should be starting a document with "things that will break"? 14:38:26 rouslan: Yes, that's one step 14:38:41 smcgruer_[EST]: Also people can reach out to us directly. 14:39:13 q? 14:39:13 present+ Kaustubha_Govind 14:39:29 Ian: Do you have an initial list? 14:39:33 smcgruer_[EST]: I have a partial list 14:40:05 Ian: Any co-editor volunteers? 14:41:09 q? 14:41:43 -> https://github.com/w3c/webpayments/issues General WPWG repo 14:42:24 ACTION: Stephen to start to move "things that will break" list to that repo. 14:43:07 Stephen: Again, we'd like to hear concrete flows. 14:43:23 ...e.g., part of a flow might be for a wallet to give back some data to the merchant to give to their payment processor. 14:43:44 ...what mechanisms are we using to take these steps, and what would a world look like where primitives would not be abused. 14:44:00 ...we've mostly thought about 3p cookies but we need to start looking beyond those mechanisms. 14:44:21 ...as an aside, this is a general browser direction and so we presume the payments industry has ALREADY been affected. 14:44:40 ...if the world hasn't yet burned down, why are things still working? What does that tell us? 14:44:48 q? 14:45:14 zakim, close this item 14:45:14 agendum 1 closed 14:45:15 I see 2 items remaining on the agenda; the next one is 14:45:15 2. TPAC Recap [from Ian] 14:45:19 zakim, take up item 2 14:45:19 agendum 2 -- TPAC Recap -- taken up [from Ian] 14:45:43 -> https://github.com/w3c/webpayments/wiki/Agenda-TPAC2021 Minutes linked from the agenda 14:47:47 Ian: Rouslan, you asked questions in 3DS WG discussion. Any movement after those? 14:47:51 Rouslan: Not yet 14:48:44 Ian: We also want to connect to anti-fraud discussions 14:48:59 Kaustubha: I'm working on sandbox. One work stream we are involved in is anti-fraud. 14:49:22 ...we recognize that anti-fraud solutions rely on 3p cookies, data collection, etc. 14:49:41 ...client IP addresses, etc. 14:50:00 ...across the industry browsers, OSes and so forth have been working towards making some of these signals harder to use to track users. 14:50:12 ...we want to be doing this responsibly. 14:50:31 https://www.w3.org/community/blog/2021/11/03/proposed-group-anti-fraud-community-group/ 14:50:56 Ian: What will happen in the anti-fraud CG? 14:51:22 Kaustubha: We'll start by listening. We are working on trust tokens, for example. 14:51:42 ...we want to hear about use cases, requirements, and constraints. 14:51:46 q+ 14:52:54 ack Ian 14:53:11 Ian: Is risk scoring part of your team's remit? the CG? 14:54:33 Kaustubha: something like that could be interesting. On Android and iOS there are native APIs regarding confidence in user. 14:54:48 ...I think exposing something like that in a privacy safe way on the web is something to consider 14:54:55 ..but we don't want to lock people out if they don't have the token. 14:55:14 ...we are experimenting with that, in relation to trust tokens. 14:55:28 Ian: Where is that conversation happening? 14:55:37 Kaustubha: WICG (via GitHub) 14:55:40 q? 14:55:52 q+ to note the sort of insights payments could bring to anti-Fraud CG 14:55:52 ...but we might ask to move it to anti-fraud CG 14:55:55 q? 14:55:58 ack smcgruer_[EST] 14:55:58 smcgruer_[EST], you wanted to note the sort of insights payments could bring to anti-Fraud CG 14:57:00 smcgruer_[EST]: Here's why the anti-fraud CG will be important and why payments folks should go there: there are interesting payments points of view that may not be captured .... like "trustworthy user but inappropriately using stolen card" 14:57:16 q+ 14:57:50 Kaustubha: Agreed. There are some post-facto activities and some not; we are hoping to identify what signal fidelity is needed for different use cases. 14:58:10 ...e.g., want to discard tokens when users log out 14:58:19 zakim, close the queue 14:58:19 ok, Ian, the speaker queue is closed 14:58:34 Kaustubha: As we make progress, we can make touch points with this WG. 14:58:54 q- 14:59:01 (Found the way to show my support 14:59:08 Ian: See also the WPSIG 14:59:44 [WE CELEBRATE CG LAUNCH!] 15:00:08 zakim, close this item 15:00:08 agendum 2 closed 15:00:09 I see 1 item remaining on the agenda: 15:00:09 3. Next meeting [from Ian] 15:00:12 zakim take up item 3 15:00:34 RRSAGENT, make minutes 15:00:36 I have made the request to generate https://www.w3.org/2021/11/04-wpwg-minutes.html Ian 15:00:37 RRSAGENT, set logs public 16:49:36 kirkwood has joined #wpwg 17:15:20 bkardell_ has joined #wpwg