17:00:57 RRSAgent has joined #wpwg-spc 17:00:57 logging to https://www.w3.org/2021/11/29-wpwg-spc-irc 17:01:01 Meeting: SPC task force 17:01:03 Chair: Ian 17:01:09 present+ 17:01:12 present+ Susan_Pandy 17:01:16 present+ Anne_Pouillard 17:01:31 present+ Jeff_Hodges 17:01:34 Agenda: https://lists.w3.org/Archives/Public/public-payments-wg/2021Nov/0016.html 17:01:36 Scribe: Ian 17:01:59 present+ Stephen_McGruer 17:02:03 present+ John_Bradley 17:02:20 regrets+ Adrian_Hope-Bailie 17:02:38 present+ Werner_Bruinings 17:02:55 Topic: Cross-origin Web Authen 17:02:58 https://github.com/w3c/webauthn/issues/1667#issuecomment-975770111 17:03:05 present+ Gerhard_Oosthuizen 17:03:11 werner has joined #wpwg-spc 17:03:15 present+ Doug_Fisher 17:03:31 Gerhard has joined #wpwg-spc 17:03:44 https://github.com/w3c/webauthn/issues/1667#issuecomment-975770111 17:04:12 present+ Christian_Aabye 17:04:21 John_Bradley: I've not yet expanded on the WebAuthn thread. 17:04:36 ...not yet everyone on board about using userid. 17:04:45 ...the other approach is two namespaces for rpid 17:05:01 q+ 17:05:07 ack stm 17:05:10 ack sm 17:05:22 smcgruer_[EST]: Interesting question - how would we resolve this one way or another. 17:06:09 John_Bradley: Implementer buy-in affects implementation 17:06:59 Gerhard: One of the most prolific publishers of data on SCA is from a browser vendor 17:07:09 ...maybe we could arrange for a discussion 17:08:49 q+ Doug 17:09:07 Ian: What data do we have? 17:09:07 Gerhard: EU said you have to do 2 factor for payments and for login 17:09:18 ...it's valuable to have fewer registrations from a ux experience 17:09:43 ...we've seen in the banking app and GSM environment value of using same token for both use cases 17:11:00 Doug: Regarding resolving this. Although I can't speak for EMVCo, might be a channel for gathering information about bank requirements. I could raise this in 3DS WG so that members can raise it internally 17:11:23 ...I think registration of credentials is a difficult area for us to solve, and I think banks would want to leverage existing investments. 17:11:44 ...I think they would definitely prefer an environment where credentials could be used in both use cases. 17:12:09 John_Bradley: The question is: there is nothing that stops an authentication from also being an SPC credential, but the SPC credential only works with the issuer's origin 17:12:26 ...but what we are discussing is what happens when you want to use these credential from 3p origins 17:13:12 Doug: I think that RPs will want to use SPC credentials for login 17:13:16 ...in a 1p context 17:14:51 Gerhard: I expect that the flow will be: (1) register for login (2) register for payments from 1p (3) Register for 3p SPC 17:15:15 ...in FAPI flow, there will be full redirect to bank domain. 17:15:25 ...even there again, it's a 1p context 17:15:38 ...3DS is really the only environment that involves 3p auth 17:16:01 q? 17:16:11 q+ 17:16:31 regrets+ Praveena 17:16:33 ack Doug 17:17:09 q+ 17:17:33 John_Bradley: The two proposals are the same as to whether the bank can use it. 17:17:42 ...we also to consider the "no allow" use case 17:17:43 ack smcgruer_[EST] 17:18:12 smcgruer_[EST]: I would like to hear from our partners who are experimenting to see whether "register for login" is the first use case we'll see. 17:18:57 ...I would speculate that if you are looking at a case, for example, where a PSP is doing delegated authentication, the PSP might do SPC as the RP. 17:20:09 Gerhard: Merchants ALSO want to use FIDO for both login and payment 17:20:25 ack me 17:21:10 question: Could we look at the Microsoft counter proposal, and it's implications? 17:21:30 q+ Doug 17:22:09 IJ: another approach is making N registrations easier. 17:22:20 John_Bradley: There is a concept of user verification caching; but not implemented. 17:22:32 ...there is practically a requirement for some user action for registration 17:22:48 ...that could change but would be a large change to the infrastructure 17:25:12 Jeff_Hodges: I am hearing the concern is "How many use gestures are required to acquire enough credentials to satisfy the use cases." 17:25:47 John_Bradley: Yes, I hear that is what Ian is trying to say. 17:26:12 ...that's called user verification caching but there are no instances of that that I know of 17:27:19 Gerhard: If MS is proposing an alternative, have we reviewed that? 17:27:43 John_Bradley: I am not sure there's an alternative (to "other namespace" approach) 17:29:36 ack Doug 17:29:59 Doug: I think there is a use case where SPC credentials would be created first and extended after to login id. 17:30:19 ...we don't want user to have to select from a list of valid credentials. 17:30:42 ...don't want to move friction from credential creation to payment transaction. 17:30:47 q? 17:32:57 John_Bradley: Question is "Why should WebAuthn allow dual use of a cross-origin credential?" 17:39:08 Topic: Next meeting 17:39:13 6 Dec 17:39:16 RRSAGENT, make minutes 17:39:16 I have made the request to generate https://www.w3.org/2021/11/29-wpwg-spc-minutes.html Ian 17:39:19 RRSAGENT, set logs public