IRC log of wpwg on 2022-05-05
Timestamps are in UTC.
- 13:48:23 [RRSAgent]
- RRSAgent has joined #wpwg
- 13:48:23 [RRSAgent]
- logging to https://www.w3.org/2022/05/05-wpwg-irc
- 13:48:32 [Ian]
- Meeting: Web Payments Working Group
- 13:48:49 [Ian]
- Agenda: https://github.com/w3c/webpayments/wiki/Remote-Agenda-202205
- 13:48:55 [Ian]
- Scribe: Ian
- 13:49:07 [Ian]
- RRSAGENT, make minutes
- 13:49:07 [RRSAgent]
- I have made the request to generate https://www.w3.org/2022/05/05-wpwg-minutes.html Ian
- 13:49:10 [Ian]
- RRSAGENT, set logs public
- 13:51:27 [Ian]
- present+ Ian_Jacobs
- 13:59:39 [Ian]
- present+ Stephen_McGruer
- 13:59:43 [Ian]
- present+ John_Bradley
- 14:00:17 [Ian]
- present+ Erhard_Brand
- 14:00:36 [Ian]
- present+ Carey_Ferro
- 14:00:40 [Ian]
- present+ Steve_Cole
- 14:00:52 [Carey]
- Carey has joined #wpwg
- 14:01:24 [Ian]
- present+ Nick_Burris
- 14:01:27 [Ian]
- present+ Haribalu_V
- 14:01:37 [Ian]
- present+ Praveena_Subrahmanyam
- 14:01:42 [Ian]
- present+ Anne_Pouillard
- 14:01:52 [Ian]
- present+ Bart_de_Water
- 14:01:57 [Ian]
- present+ Richard_le_Dain
- 14:02:12 [praveenas]
- praveenas has joined #wpwg
- 14:02:19 [Anne]
- Anne has joined #wpwg
- 14:02:58 [Ian]
- present+ Adam_Kelly
- 14:03:05 [Ian]
- present+ Jayadevi
- 14:03:08 [Ian]
- present+ Michael_Horne
- 14:03:18 [Ian]
- present+ Doug_Fisher
- 14:03:22 [Ian]
- present+ Uno_Veski
- 14:03:25 [Ian]
- present+ Ryan_Watkins
- 14:03:31 [Ian]
- present+ Hemnath
- 14:03:42 [bdewater]
- bdewater has joined #wpwg
- 14:04:10 [Ian]
- present+ Christiaan_Brand
- 14:04:17 [dougf]
- dougf has joined #wpwg
- 14:04:24 [Uno]
- Uno has joined #wpwg
- 14:04:56 [Ian]
- present+ Sameer_Tare
- 14:05:02 [Ian]
- present+ Gerhard_Oosthuizen
- 14:05:15 [Gerhard]
- Gerhard has joined #wpwg
- 14:05:17 [Gerhard]
- present+
- 14:05:50 [Hemnath]
- Hemnath has joined #wpwg
- 14:06:35 [Ian]
- present+ John_Fontana
- 14:07:45 [Ian]
- Topic: Web Authentication WG
- 14:08:16 [Ian]
- present+ Sami_Tikkala
- 14:08:20 [Ian]
- present+ Tomoya_Horiguchi
- 14:08:37 [Ian]
- present+ Anwar_Moco
- 14:08:37 [bryanluo]
- bryanluo has joined #wpwg
- 14:08:42 [Ian]
- present+ Bryan_Luo
- 14:09:29 [Ian]
- present+ Manish_Garg
- 14:11:31 [Ian]
- present+ Tim_Cappalli
- 14:16:29 [Ian]
- http://www.w3.org/2022/Talks/wpwg-authn-202205/wpwga-202205.pptx
- 14:16:29 [Ian]
- http://www.w3.org/2022/Talks/wpwg-authn-202205/wpwga-202205.pptx
- 14:17:09 [Ian]
- IJ: What is status of request to FIDO2TWG?
- 14:17:32 [Ian]
- smcgruer_[EST]: Proposal has been made; we had an initial discussion on Tuesday (this week); they have assigned some reviewers.
- 14:17:54 [Ian]
- present+ Krithi
- 14:18:09 [Ian]
- John_Bradley: Will be a topic of conversation at FIDO plenary in 2 weeks
- 14:18:23 [Ian]
- ...after a first read of the proposal extension makes sense.
- 14:18:30 [Ian]
- ...will probably have to have discussions about what the response means.
- 14:18:59 [Ian]
- ...if a fido authenticator does not understand the bit you won't get it back in the response; that could be a useful signal
- 14:19:25 [Ian]
- ...what goes into the extension and how is it treated by the RP?
- 14:19:53 [Ian]
- John_Bradley: Rather than have the platform management flags, I prefer the individual extension flag to allow authenticators to manage the storage.
- 14:20:10 [Ian]
- Ian: Who is participating from WPWG in the FIDO meeting?
- 14:20:14 [benoit]
- benoit has joined #wpwg
- 14:20:42 [Ian]
- Christiaan: I"ll be there and will work with Stephen
- 14:21:32 [Ian]
- present+ David_Benoit
- 14:21:43 [Ian]
- Ian: For WebAuthn, what has to happen and how do we get it done?
- 14:21:54 [Ian]
- JohN_Bradley: WebAuthn just passes through the extension during create().
- 14:22:09 [Ian]
- Ian: Is the extension defined in a W3C specification?
- 14:22:16 [smcgruer_[EST]]
- q+
- 14:22:17 [Ian]
- John_Bradley: It would more likely be CTAP
- 14:22:50 [Ian]
- ...since relies on changes to the protocol
- 14:23:06 [Ian]
- ack smcgruer_[EST]
- 14:23:42 [Ian]
- smcgruer_[EST]: Agree that there are no "client processing steps" at creation time.
- 14:23:48 [Steve_C]
- Steve_C has joined #wpwg
- 14:24:14 [Ian]
- ...but for WebAuthn folks, given that we want to expose this in a way similar to Conditional UI, is there a WebAuthn spec change for credential listing APIs?
- 14:24:41 [Ian]
- ChristiaanBrand: We are talking about the client querying the story; this is outside of scope of WebAuthn itself IMO
- 14:24:55 [smcgruer_[EST]]
- s/story/credential store
- 14:24:57 [SameerT]
- SameerT has joined #wpwg
- 14:25:07 [SameerT]
- present+
- 14:25:11 [Ian]
- John_Bradley: Because platform authenticators do some proprietary things, there is no defined API between browser and platform authenticator.
- 14:25:31 [Ian]
- ...closest we may have is Akshay API that will expose information from windows platform authenticator to browsers running on windows.
- 14:25:37 [Ian]
- ...but that's not in any specification.
- 14:26:00 [Ian]
- smcgruer_[EST]: So I hear 2 work streams (1) working with platform authenticators (2) for remote authenticators, CTAP changes
- 14:26:32 [Ian]
- John_Bradley: We have to figure out in CTAP a standardized way to say "this bit is exposed this way in credential management output"
- 14:27:00 [Ian]
- ...there are two ways the platform could get at the information, doing a get() with or without allow list and iterating through credential list, or using credential management API.
- 14:27:23 [smcgruer_[EST]]
- q+ to comment on SPC's extension today - https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration
- 14:27:25 [Ian]
- q?
- 14:28:02 [Ian]
- John_Bradley: Some of this is CTAP work and will require collaboration.
- 14:28:03 [Ian]
- ack smcgruer_[EST]
- 14:28:03 [Zakim]
- smcgruer_[EST], you wanted to comment on SPC's extension today - https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration
- 14:28:48 [Ian]
- smcgruer_[EST]: We do have an extension in the SPC spec. At registration time, the client extension steps (1) enable cross-origin creation, which we'd like to move out of SPC (2) they do some enforcement on forcing discoverable credentials, etc.
- 14:28:55 [Ian]
- ...we might be able to remove client steps at registration
- 14:29:07 [Ian]
- ..but at authentication time, we put payment information in client data.
- 14:29:20 [Ian]
- ...we'll either need to move this into WebAuthn or keep it in SPC.
- 14:29:25 [Ian]
- ...are you ok with an extension defined in SPC
- 14:29:30 [Ian]
- present+ Tony_Nadalin
- 14:29:50 [Ian]
- John_Bradley: Probably most appropriate for WebAuthn
- 14:30:15 [Ian]
- ...we should also consider whether the extension information is passed on through to the authenticator so that authenticators with displays can also display it.
- 14:30:37 [Ian]
- ...e.g., CABLE scenario, where the display of information can be displayed on different screens.
- 14:30:51 [Ian]
- ...there are reasons to prefer mobile device (e.g., less malware)
- 14:31:04 [Ian]
- ...so there's probably a good argument for passing data through to authenticators that can display it
- 14:31:32 [Ian]
- q?
- 14:32:07 [smcgruer_[EST]]
- q+
- 14:32:31 [Ian]
- [Brief side discussion on I18N here]
- 14:32:54 [Ian]
- John_Bradley: Note that the authenticator would not be storing some information (due to space constraints)
- 14:33:04 [Ian]
- ack smcgruer_[EST]
- 14:33:34 [Ian]
- smcgruer_[EST]: How should we resolve question of where information goes?
- 14:34:13 [Ian]
- John_Bradley: We have to figure out what comes back in the extension (e.g., hash of what was displayed) that can be compared to collected client data.
- 14:34:27 [Ian]
- smcgruer_[EST]: I think the payment industry needs it to be signed over.
- 14:34:38 [Ian]
- John_Bradley: In the signed extension you'd get back a hash of what the display information was.
- 14:35:32 [jonathan_]
- jonathan_ has joined #wpwg
- 14:37:09 [Ian]
- John_Bradley: We need to be sure that in the spec, if we are going with extension, that existing roaming authenticators without this extension would still be usable with SPC in a 1p context, assuming they support discoverable credentials.
- 14:37:27 [Ian]
- ...we should make sure that, in the short term, the population of existing roaming authenticators work in a 1p context.
- 14:37:52 [Ian]
- John_Bradley: As long as we define the extension in the right way, it should make that easier.
- 14:39:49 [Ian]
- John_Bradley: When WebAuthn client sees extension for special bit, then the client may take multiple paths to enumerate available credentials.
- 14:39:56 [Ian]
- ...so there's probably some platform processing things that we'd want to change.
- 14:40:07 [Ian]
- present+ Jonathan_Grossar
- 14:40:15 [Ian]
- present+ Christian_Aabye
- 14:40:29 [Hemnath_]
- Hemnath_ has joined #wpwg
- 14:40:39 [Ian]
- John_Bradley: Some of that extension processing would happen only in the SPC context.
- 14:42:03 [Ian]
- Things that have to be done:
- 14:42:07 [Ian]
- * Define the extension
- 14:42:13 [Ian]
- * Figure out the UI (and where that is specified)
- 14:42:27 [Ian]
- Tony: We have to look at "is this useful for anything else for webAuthn?"
- 14:43:17 [Ian]
- ChristiaanBrand: We should look at generic transaction signing again in WebAuthn
- 14:45:02 [Ian]
- present+ Wendy_Seltzer
- 14:45:06 [Ian]
- [Issue 154]
- 14:45:30 [Ian]
- John_Bradley: Anybody that implements a user dialog about opt-ing out. I think this should not be in WebAuthn. Could be done at the platform layer.
- 14:45:52 [smcgruer_[EST]]
- +1
- 14:45:52 [Ian]
- ...e.g., chrome could allow someone to allow setting the bit, and the RP would know because they would not get the extension back.
- 14:46:11 [smcgruer_[EST]]
- q?
- 14:46:26 [Ian]
- Tony: If we leave it up to the platform to do the dialog, it will be done differently everywhere, which will also be confusing.
- 14:46:50 [Ian]
- John_Bradley: Saying you need to do a dialog has not created conformity across browsers to date.
- 14:47:04 [Ian]
- John_Bradley: I'm against forcing browsers to have this dialog.
- 14:47:07 [Ian]
- Tony: +1
- 14:48:10 [Ian]
- John_Bradley: Extra dialogs will create drop-off. We may see banks, for example, causing users to create 2 credentials (one for 1p, one for 3p)
- 14:48:33 [smcgruer_[EST]]
- q+
- 14:49:20 [Ian]
- smcgruer_[EST]: I don't think from a user perspective that SPC is different here from WebAuthn in an iframe.
- 14:49:43 [Ian]
- Tim: I agree with that point. This discussion reraises issue of naming RPIDs in dialog
- 14:50:22 [Ian]
- [Issue 128]
- 14:51:01 [Ian]
- smcgruer_[EST]: There is an existing tracking concern around WebAuthn and tracking, where RP somehow registers user in a malicious context, and then later the malicious tracker activates web authn in a 3p context.
- 14:51:21 [Ian]
- ...our privacy folks said SPC lowers bar slightly during registration (in a cross-origin iframe).
- 14:51:29 [Ian]
- ...there are protections against this (e.g,. permissions policy)
- 14:51:36 [Ian]
- ...so our privacy folks asked for user activation
- 14:51:44 [Ian]
- ...so our plan is to fold this in.
- 14:52:48 [Ian]
- Tony: This would affect WebAuthn (user activation)
- 14:53:18 [Ian]
- smcgruer_[EST]: It only affects you if you are creating a payment-labeled credential. Longer term could be better in WebAuthn.
- 14:55:23 [SameerT]
- +1 to Stephen's point
- 14:55:25 [Ian]
- smcgruer_[EST]: we would like to have the conversation about cross-origin registration in WebAuthn; payment industry partners would like that in order to use more WebAuthn
- 14:55:42 [Ian]
- John_Bradley: Is this "user activation" for iframe only or all credentials?
- 14:55:51 [Ian]
- smcgruer_[EST]: Currently it's only for cross-origin create
- 14:56:11 [Ian]
- John_Bradley: Cross-origin creation not allowed in WebAuthn; if we add it, then user activation is probably a good idea.
- 14:56:43 [smcgruer_[EST]]
- s/Currently//
- 14:57:22 [Manish]
- Manish has joined #wpwg
- 14:58:12 [Ian]
- [Issue 12 roaming authenicators]
- 14:58:30 [Ian]
- John_Bradley: We heard from BPCE yesterday that they would want roaming authenticators.
- 14:58:59 [Gerhard]
- q+
- 14:59:03 [Ian]
- ack smcgruer_[EST]
- 14:59:06 [smcgruer_[EST]]
- q-
- 14:59:08 [Ian]
- ack Gerhard
- 14:59:32 [Ian]
- Gerhard: Yes, we would love roaming authenticators. But for it to roam, we would need "no caching"
- 15:00:12 [smcgruer_[EST]]
- q+
- 15:00:18 [Ian]
- John_Bradley: Browser only needs to store information for credentials to be used in a 3p context.
- 15:00:26 [Ian]
- ...would work now without that bit in a 1p context.
- 15:00:49 [Ian]
- ack smcgruer_[EST]
- 15:01:18 [Ian]
- smcgruer_[EST]: The important part of SPC is we only show the transaction dialog when there is a chance the user can succeed (a form of conditional UI, as it were).
- 15:01:43 [Ian]
- ..it means there's a matching credential nearby. This is trickier for roaming authenticators. Today we do it for platform authenticators via cached data.
- 15:01:57 [Ian]
- ...if we want to do it without the spc bit, we'd need to cache ALL FIDO credentials.
- 15:02:45 [Ian]
- John_Bradley: The SPC bit is about "this credential can be used in a 3p context for SPC".
- 15:03:18 [Ian]
- ...I think banks will want to be able to use FIDO credentials with SPC in a 1p context.
- 15:03:44 [Ian]
- Christiaan: I think this roaming authenticators for bank use cases is a great use case.
- 15:04:11 [Ian]
- John_Bradley: The question is the SPC dialog ... to cause SPC to go look for another authenticator.
- 15:04:36 [Ian]
- Ian: How is this managed today?
- 15:04:57 [Ian]
- John_Bradley: Non-modal UI is not there yet but coming. I believe there will be an additional option for roaming authenticators.
- 15:05:21 [Ian]
- ...we did start a conversation on pairing a roaming authenticator with platform so that credentials could be pre-populated and cached.
- 15:05:39 [Ian]
- ...it's not really a problem if all discoverable credentials are displayed.
- 15:05:52 [Ian]
- ...if it's not appropriate for SPC, then the verifier should not be sending the credential ID
- 15:06:23 [Ian]
- q?
- 15:06:46 [smcgruer_[EST]]
- q+
- 15:06:55 [Ian]
- John_Bradley: We'd have to understand conditions under which this optional UX could be displayed.
- 15:07:18 [Ian]
- ...would need to indicate that someone wants to use an external authenticator.
- 15:07:35 [Ian]
- ...not sure that cacheing all the credentials from roaming authenticators is that big a problem.
- 15:07:50 [Ian]
- smcgruer_[EST]: The cacheing idea is interesting, but might be better at platform level rather than browser level.
- 15:08:17 [Ian]
- Tim: There's definitely a benefit of link type function at OS
- 15:08:32 [Ian]
- Christiaan: Are we saying that new roaming authenticators won't work?
- 15:08:57 [Ian]
- John_Bradley: Maybe first time you plug in your key you are asked "do you want to use this for secure payments"
- 15:09:14 [Ian]
- Tim: I think it would be like when you plug phone into computer and there's a pairing experience / dialog
- 15:09:24 [Ian]
- Christiaan: I Think sounds reasonable to cache data
- 15:09:26 [Gerhard]
- q+
- 15:09:36 [Ian]
- John_Bradley: We can do this now with credential management
- 15:09:38 [Ian]
- ack Gerhard:
- 15:09:39 [Ian]
- ack Gerhard:
- 15:09:55 [Ian]
- Gerhard: We don't want to deviate in UX and other processes.
- 15:10:38 [Ian]
- ...if 3DS sends back 5 credentials (2 platform, 2 phone, 1 roaming)....I am hearing that Stephen wants to know that there are 2 that work
- 15:10:45 [Ian]
- ...Stephen is cacheing the first two
- 15:11:40 [Ian]
- ...until we are clear on WebAuthn way forward, we don't want to implement it in SPC
- 15:11:58 [Ian]
- q?
- 15:12:00 [Ian]
- ack Gerhard
- 15:12:21 [Ian]
- ack smcgruer_[EST]
- 15:12:48 [Ian]
- [Stephen shows a demo]
- 15:13:49 [Ian]
- ...you could plug in security key in dialog that tells user no credential found.
- 15:14:14 [Ian]
- ...so in this case, WebAuthn ceremony could be triggered first, and then only after the tx dialog would be shown
- 15:14:51 [Ian]
- ...if I've never registered, there is a UX issue.
- 15:15:12 [Ian]
- ...I like John's pre-cacheing idea but even without that there are some things we could do.
- 15:16:36 [Ian]
- John_Bradley: If Non-modal UI is used to get the list of credentials; that can also be used to expose the credentials from roaming authenticators
- 15:17:07 [SameerT]
- q+
- 15:17:10 [Ian]
- ack SameerT
- 15:17:32 [Ian]
- SameerT: Does the RP know that a credential comes from a roaming authenticator?
- 15:17:38 [Ian]
- John_Bradley: You get back a transport hint.
- 15:17:51 [Ian]
- ...so "USB" and "NFC" and "BLE" give you some information
- 15:18:06 [dom]
- dom has joined #wpwg
- 15:18:58 [Ian]
- Tony: Are you sure this is checked at certification?
- 15:19:10 [Ian]
- JohN_Bradley: It is checked that it is provided; not that it is accurate
- 15:19:40 [Ian]
- SameerT: If the RP knows that the device being used is a roaming authenticator, they may not send it if the UX will break.
- 15:19:47 [smcgruer_[EST]]
- q?
- 15:22:07 [dom]
- RRSAgent, pointer
- 15:22:07 [RRSAgent]
- See https://www.w3.org/2022/05/05-wpwg-irc#T15-22-07
- 15:23:49 [Ian]
- [SPC 174]
- 15:23:57 [Ian]
- John_Bradley: Depends on timing; when extension codified.
- 15:24:03 [Ian]
- ...we should probably redefine the extension.
- 15:24:09 [Ian]
- ..the extension is "Device Public Key"
- 15:24:27 [Ian]
- ...please return me a flag so that I can tell whether the credential is being used on the same device or a new device.
- 15:24:40 [Ian]
- ..for security purposes a verifier can tell whether this is a new device.
- 15:25:03 [Ian]
- Tim: The RP does NOT need to request the extension.
- 15:25:16 [Ian]
- ...the flag is set at creation time
- 15:25:58 [Ian]
- John_Bradley: We should make sure that SPC causes platform discoverable credentials created on Android to emit the device public key extension
- 15:26:26 [Ian]
- Tim: Suggest not hard coding the extension in SPC
- 15:27:21 [Ian]
- John_Bradley: If we don't require it as "always being required" then we need to tell all merchants that they need to include it. Request is potentially coming from a 3p
- 15:27:29 [Ian]
- ...that's why making it mandatory in SPC would simplify some things
- 15:27:34 [Ian]
- Tim: I do agree with that.
- 15:28:02 [Ian]
- Tim: Are these banking folks ok with the change?
- 15:29:33 [Ian]
- Jonathan_Blocksom: Here at Capital One, we'd send fact of new device to our risk engine; it would probably send a request for MFA at that point.
- 15:29:37 [Ian]
- present+ Joe_Vasterling
- 15:29:55 [Ian]
- Tim: That's exactly how we imagine this being used. So I guess I am in favor of requiring it.
- 15:30:49 [Ian]
- ACTION: Ian to work with all the chairs to schedule continued coordination time with WebAuthn
- 15:31:01 [Ian]
- RRSAGENT, make minutes
- 15:31:01 [RRSAgent]
- I have made the request to generate https://www.w3.org/2022/05/05-wpwg-minutes.html Ian
- 15:31:26 [Ian]
- Topic: Best Buy experience with WebAuthn for Login
- 15:32:20 [Ian]
- Joe: We've been looking at WebAuthn for frictionless login with good security
- 15:33:06 [Ian]
- ...there is an option to select WebAuthn to log into your profile
- 15:33:19 [Ian]
- ...there are a few hurdles we've seen
- 15:33:25 [Ian]
- ..first one is "what do we call this"?
- 15:33:49 [Ian]
- ...it's not easy to relay to customer what they will be doing.
- 15:34:01 [Ian]
- q+ Tony
- 15:34:34 [Ian]
- Joe: We are also hearing from our devs that the technical documents can be confusing / in complete.
- 15:34:57 [Ian]
- ack Tony
- 15:35:16 [Ian]
- Tony: Do you think people understand what WebAuthn is? They understand "sign in with Google" etc.
- 15:35:29 [Ian]
- Joe: I agree. That friction we are feeling is that consumers may not get it
- 15:35:55 [Ian]
- ...they are starting to communicate more closely to familiar phrases.
- 15:36:20 [Ian]
- Tim: In the press today we are making an industry push to call this "Use a Passkey"
- 15:36:30 [Ian]
- ...we'd like to move away from platform specific branding
- 15:36:34 [Ian]
- ...we are pushing strongly for this.
- 15:36:42 [bdewater]
- https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/ & https://blog.google/technology/safety-security/one-step-closer-to-a-passwordless-future/ & https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/ :)
- 15:38:01 [Ian]
- Tim: We think this is a good approach moving forward.
- 15:38:34 [Ian]
- Joe: Where are we in our journey? Testing and learning.
- 15:38:51 [Ian]
- ...I appreciate the press release today describes things that will be helpful from a UX perspective.
- 15:39:48 [Ian]
- [Joe shows a demo of how this works today on bestbuy.com]
- 15:39:57 [Ian]
- present+ Dominique_Hazael-Massieux
- 15:40:09 [smcgruer_[EST]]
- q+
- 15:40:38 [Ian]
- [Joe lists benefits of using FIDO over passwords]
- 15:40:50 [Ian]
- Joe: We see the value; key is to test and learn
- 15:40:59 [Ian]
- ack smcgruer_[EST]
- 15:41:12 [Ian]
- smcgruer_[EST]: Small question on the demo - right at the start there is a best buy mobile UI
- 15:41:20 [Ian]
- ...did the user click a button to cause that modal to show up?
- 15:41:39 [Ian]
- Joe: It pops up post registration
- 15:43:35 [Ian]
- Ian: Anybody want to speak to documentation?
- 15:44:07 [Gerhard]
- q+
- 15:44:10 [dom]
- q+
- 15:44:14 [Ian]
- ack Gerhard
- 15:44:35 [Ian]
- Gerhard: Regarding the device spread you've seen with this (between Mac, Windows, Android)...
- 15:45:02 [Ian]
- Joe: Right now primarily on desktop (Chrome, Edge)
- 15:45:23 [Ian]
- ...for our in-app experience, I could see what information we are seeing in terms of adoption.
- 15:46:08 [Ian]
- Dom: Thank you for the presentation. You indicate that your team found gaps in documentation. Is that documentation on the API itself, or the overall user journey with WebAuthn? We have a WebAuthn Adoption CG
- 15:46:22 [Ian]
- ...we'd be keen to get feedback from your team on challenges they hit
- 15:46:25 [dom]
- -> https://www.w3.org/community/webauthn-adoption/ WebAuthn Adoption Community Group
- 15:46:41 [Ian]
- Joe: The big piece was API documentation.
- 15:46:50 [Ian]
- ...the documentation was perceived as "confusing"
- 15:47:06 [Ian]
- ...they felt it was incomplete; they had to figure out how to connect the dots to make the final API call.
- 15:47:31 [Ian]
- ...I can ask internally for more specific.
- 15:48:04 [Ian]
- q?
- 15:48:07 [Ian]
- ack me
- 15:48:09 [Ian]
- ack dom
- 15:48:25 [Ian]
- Ian: Plans?
- 15:48:30 [Ian]
- Joe: It's on and people are monitor ing
- 15:48:41 [Ian]
- ...we are also getting feedback through surveys
- 15:48:49 [Ian]
- s/monitor ing/monitoring/
- 15:49:15 [Ian]
- ...I think there is interest in using this an expanding where we can
- 15:49:49 [Ian]
- John_Fontana: Are you using this in an enterprise context?
- 15:49:58 [Ian]
- Joe: I don't think they are looking at this today
- 15:50:16 [Ian]
- ...I will check with technical teams on other interests.
- 15:51:08 [Ian]
- Topic: User Recognition
- 15:51:45 [smcgruer_[EST]]
- Ian: [Presenting slide deck]
- 15:52:07 [smcgruer_[EST]]
- ... talked previously in this WG around changes in privacy in browsers
- 15:52:13 [smcgruer_[EST]]
- ... at TPAC people said user recognition important
- 15:52:22 [smcgruer_[EST]]
- ... two threads (1) fraud mitigation, (2) returning users for flows like SRC
- 15:52:41 [smcgruer_[EST]]
- ... Update: Anti-Fraud CG started meeting this year; so far approved charter and close to approving use-cases
- 15:52:51 [smcgruer_[EST]]
- ... some emerging proposals for the use-cases
- 15:53:03 [smcgruer_[EST]]
- ... Have invited them to the WPWG to share updates
- 15:53:51 [smcgruer_[EST]]
- ... On the returning user flow; some use-cases have come up - SRC (remember SRC identity), Open Banking (remember preferred bank), ...
- 15:54:34 [smcgruer_[EST]]
- ... There are some approaches without 3p cookies with UX: pop-up, Storage Access API, WebAuthn+Conditional UI
- 15:55:01 [smcgruer_[EST]]
- ... For conditional UI, strongly attached to autofill in Chrome currently, but we may be interested in other experiences that aren't autofill-based. For later discussion with WebAuthn WG
- 15:55:34 [smcgruer_[EST]]
- ... Other technologies that don't seem applicable: Trust Tokens, isLoggedIn - they both lack user info
- 15:56:22 [smcgruer_[EST]]
- ... The First Party Sets proposal may be useful for use-cases like SRC, where there are multiple networks
- 15:57:19 [smcgruer_[EST]]
- ... to wrap-up - want to look at Conditional UI for SRC
- 15:57:31 [smcgruer_[EST]]
- ... plus - what are we missing in general?
- 15:58:30 [Ian]
- smcgruer_[EST]: There's a slightly broader scope for user recognition than you speak to: there are also use cases where PSPs have experiences they want to provide across merchants.
- 15:58:40 [Ian]
- ..suppose I have "Stephen's Shop" online
- 15:59:09 [Ian]
- ...I think there are more use cases than Ian covered.
- 15:59:25 [Ian]
- q?
- 16:00:42 [Ian]
- Topic: Next meeting
- 16:00:43 [Ian]
- 26 May
- 16:01:21 [Ian]
- RRSAGENT, make minutes
- 16:01:21 [RRSAgent]
- I have made the request to generate https://www.w3.org/2022/05/05-wpwg-minutes.html Ian
- 16:01:27 [Ian]
- RRSAGENT, set logs public
- 16:01:42 [Gerhard]
- Thanks for all the preparations and material, Ian! Great sessions.
- 16:45:09 [bryanluo]
- bryanluo has joined #wpwg
- 16:46:15 [Ian]
- /dialog koalie
- 17:16:41 [bryanluo]
- bryanluo has joined #wpwg
- 17:17:11 [bryanluo_]
- bryanluo_ has joined #wpwg
- 17:18:59 [bryanluo]
- bryanluo has joined #wpwg
- 17:35:41 [bryanluo]
- bryanluo has joined #wpwg
- 18:01:33 [bkardell_]
- bkardell_ has joined #wpwg
- 18:17:23 [Zakim]
- Zakim has left #wpwg