16:57:02 RRSAgent has joined #wpwg-spc 16:57:02 logging to https://www.w3.org/2021/12/13-wpwg-spc-irc 16:57:06 Meeting: SPC Task Force 16:57:10 Chair: Ian 16:57:21 Agenda: https://lists.w3.org/Archives/Public/public-payments-wg/2021Dec/0012.html 16:57:24 Scribe: Ian 16:57:34 Regrets+ Praveena, Gerhard 16:57:39 present+ Ian_Jacobs 16:58:25 agenda+ Payments/login use cases 16:58:28 agenda+ next meeting 16:59:50 present+ Stephen_McGrueur 16:59:53 present+ John_Bradley 17:00:42 present+ Anne_Pouillard 17:01:28 present+ Jeff_Hodges 17:01:33 present+ Tim_Cappalli 17:01:37 present+ Susan_Pandy 17:01:47 zakim, take up item 1 17:01:47 agendum 1 -- Payments/login use cases -- taken up [from Ian] 17:02:26 https://github.com/w3c/secure-payment-confirmation/issues/157 17:03:33 timcappalli has joined #wpwg-spc 17:06:13 present+ Doug_Fisher 17:06:17 present+ Bastien_Latge 17:06:48 John_Bradley: Do we need to differentiate between vanilla webauthn and spa-enabled; any reason to do this in the browser? 17:07:05 q? 17:07:06 q+ 17:07:07 ..is there a requirement to do something *in the browser*? 17:07:20 ack smcgruer_[EST] 17:07:56 smcgruer_[EST]: My understanding is that we don't need something in the browser, but we've heard some people say "don't allow this to be used for payments unless RP has explicitly set it." 17:08:05 present+ Sameer_Tare 17:09:01 Anne has joined #wpwg-spc 17:09:14 John_Bradley: RP has total control for 1p use cases. 17:09:25 ...they can use two different RPID's 17:09:29 ack Doug 17:10:12 doug: Would be great if RP is tasked with deciding which RPIDs to provide to merchants 17:10:24 ..but because merchant is invoking API, could it not add to the credential list? 17:10:57 ...I'm hearing that the RP could not be assured that no other credential IDs are used by the merchant. 17:11:06 q+ 17:11:10 John_Bradley: We need to separate how to solve 1p context before we start .... 17:11:17 ...looking at 3p 17:11:37 ...if we can agree that 1p uses are ok, then we can focus on a "3p capable" flag. 17:11:38 ack smcgruer_[EST] 17:11:52 smcgruer_[EST]: From my view, I don't hear a disagreement. I think the 1p use cases are fine. 17:12:33 John_Bradley: Regarding prefix / postfix to RPID...I think akshay leaning to "postfix" such as "#payment" 17:12:40 ..if we can agree that it's a different namespace. 17:13:11 ...so if RP wants to enable SPC for both get() and create(), then they can set a new RPID 17:14:06 Ian: How to use same credential for 1p login authentication? 17:14:44 q? 17:14:50 John_Bradley: Could involve a change in the browser to recognize postfix 17:14:53 q+ 17:14:55 q+ 17:15:29 John_Bradley: As an RP if you want to use SPC in regular auth, then you will only get the 3p type (not a mix of 3p and 1p credentials) 17:15:48 ack smcgruer_[EST] 17:16:00 smcgruer_[EST]: that is one of two reasons that I think we should not do a namespace. 17:16:10 ...the first reason is the one John just cited 17:16:25 ...second reason is the need to query credentials for their existence 17:16:40 ..if we introduce a namespace to solve the first problem, we'd still need to keep the cache around 17:16:54 ...to fix that, we'd need a platform level API 17:17:13 John_Bradley: What does "is valid" to you? 17:17:35 Stephen_McGruer: We have a conditional UI sort of behavior: if authenticator is available, do X; Otherwise do Y 17:17:46 https://w3c.github.io/secure-payment-confirmation/#steps-to-silently-determine-if-a-credential-is-available-for-the-current-device 17:18:25 s/is authenticator is available/if credential is present for this authenticator/ 17:18:51 John_Bradley: you can use credential management to find credentials based on their RPs. The biggest problem with credential management is that you need to do some sort of authentication for privacy reasons before you can get at the credentials. 17:19:08 ...you can either do credential management or an allow list (with user presence = 0) 17:19:24 ..the latter works for both platform and remote authenticators if you have the credential IDs 17:19:30 ...more complicated on Windows 17:20:39 ..that would work with namespaced credentials 17:21:52 Ian: What needs to change on an RP server? 17:22:07 JOhn_Bradley: Nothing should change for the 1p other than how to recognize the typed credentials. 17:27:47 John_Bradley: If we can flag credentials without touching RPID, then we can not touch WebAuthn at all. 17:31:50 ....if we are not using RPID then "3p ok" is only necessary to be known by the SPC API. 17:32:04 Ian: How do we get the bit in the credential? 17:32:13 John_Bradley: A Webauthn extension. 17:32:40 'A WebAuthn extension' is just the mechanism for a developer to say 'I want this to happen'. It is not the bit itself. 17:33:11 John_Bradley: Platforms would have to know how to set bit / or authenticator would have to do it. 17:35:34 John_Bradley: People expect to be using fields for different things. To be backwards compatible we need to step on somebody's usage of something (userid, Cred blob, something else) 17:35:36 But we don't *have* to be backwards compatible! 17:35:52 John_Bradley: ...there may be sensitivities about stepping on existing usage. 17:36:00 ...if we want to use something other than the RPID to flag this. 17:36:05 q+ 17:36:55 John_Bradley: Having it's own data element ideal. But shy of that, re-using existing fields. If changes have to happen in the platform as opposed to the browser, the deployment lag for some platforms will need to be taken into consideration. 17:37:13 ...one advantage of using the RPID is that could be manipulated by the browser and passed through the DLL. 17:38:24 Ian: Why would RP need RPID? 17:38:35 JohN_Bradley: RP doesn't read the credential. 17:38:57 Stephen: RP's can separate credentials if they want (via RPID) 17:39:52 John_Bradley: I'm ok with long term approach, as long as you understand the consequences. 17:40:10 Tim: +1 to doing this the "right way for the long term" 17:40:25 ...John's right that the devil's in the details. But +1 to "doing it the right way." 17:41:32 Stephen: Credentials will work in short term in 3p context due to per-browser caching. 17:42:13 John_Bradley: You can go cross browser in 1p on the same device 17:42:18 I don't believe that's true due to https://w3c.github.io/secure-payment-confirmation/#steps-to-silently-determine-if-a-credential-is-available-for-the-current-device 17:42:35 (Still need a cache to do conditional showing ==> still per-browser) 17:42:41 Tim: There are other use cases where an extra bit would be valuable (e.g., a "type" field for sync in to the cloud) 17:43:01 ACTION: Stephen to work with Ian to write this up 17:43:36 Next meeting: 10 Jan 17:45:12 RRSAGENT, make minutes 17:45:12 I have made the request to generate https://www.w3.org/2021/12/13-wpwg-spc-minutes.html Ian 17:45:17 RRSAGENT, set logs public