13:58:20 RRSAgent has joined #wpwg 13:58:20 logging to https://www.w3.org/2022/05/26-wpwg-irc 13:58:22 Meeting: Web Payments WG 13:58:32 Agenda: https://github.com/w3c/webpayments/wiki/Agenda-20220526 13:58:36 Scribe: Ian 13:59:19 I have made the request to generate https://www.w3.org/2022/05/26-wpwg-minutes.html Ian 13:59:22 present+ 14:00:10 agenda+ TPAC 14:00:16 agenda+ Path to SPC/FIDO Integration in Chrome 14:00:20 agenda+ Upcoming meetings 14:00:29 present+ 14:00:48 present+ Stephen_McGruer 14:00:57 present+ Matt_Crothers 14:01:23 present+ Tomoya_Horiguchi 14:04:38 present+ Nick_Telford-Reed 14:04:46 present+ Ryan_Watkins 14:05:18 zakim, take up item 1 14:05:18 agendum 1 -- TPAC -- taken up [from Ian] 14:06:56 present+ Adrian 14:07:22 adrianhb has joined #wpwg 14:07:49 -> https://github.com/w3c/webpayments/wiki/Agenda-20220526 14:08:18 Chair: Ian 14:08:26 NickTR: Digital identity an interesting topic 14:08:40 ...PSD3 starting up 14:09:01 present+ Sue_Koomen 14:09:09 NickTR: We could revisit DIDs and VCs 14:09:27 ...I don't have a specific hypothesis yet but I'd like to explore further with likeminded folks at TPAC 14:09:51 Ian: Any canada-specific initiatives? 14:10:33 ACTION: David to look into interesting digital identity initiatives in Canada 14:11:24 Ian: I was chatting with PCI; may invite them 14:11:39 this is one interesting whitepaper from Interac (wrt to Canada, Digital ID and payments) -> https://developer.interac.ca/wp-content/uploads/2020/07/How-Do-We-Get-People-to-Use-Digital-ID.pdf 14:12:01 Ian: Anyone interested in Web3? 14:12:27 Adrian: I am interested in hearing a definition first 14:14:44 Suggest reaching out to Uchi from Coil for update on Web Monetization (he is based in Canada) or Alex from the Interledger Foundation 14:14:48 clinton has joined #wpwg 14:15:20 q? 14:15:34 Ian: Any other ideas? 14:15:53 Payment Request beyond cards sounds interesting. Lots of A2A payments springing up in places where Open Banking is getting traction 14:16:04 NickTR: On behalf of the co-Chairs; it's been a while since we got together. I have valued the hallway conversations at our FTF meetings 14:16:15 ...we are keen to create as much opportunity as we can for those conversations. 14:16:39 ...we the co-chairs can work to drum up guests and participants 14:16:43 present+ Clinton_Allen 14:17:11 ...we hope to be able to create some larger conversations among the four groups that will be there 14:17:33 ...is there appetite to hold an in-person meeting? 14:17:51 q+ 14:18:05 rwatkinsma has joined #wpwg 14:18:15 ack clin 14:18:25 +1 to in person meeting (biased because my favourite gelato place in the world is in Vancouver) 14:18:34 clinton: In terms of travel, EMVCo met in Berlin and it was well-attended and a really good meeting 14:19:24 QUESTION: Should we hold an in-person meeting in Vancouver (likely 12, 13, maybe 14 Sep) 14:19:30 +21 14:19:32 +1 14:19:32 +1 14:19:34 +1 14:19:38 MattCrothers has joined #wpwg 14:19:42 +1 14:19:47 +1 14:19:51 +1 14:19:52 +1 but will likely be unable to attend myself, not sure about other MA participants 14:20:57 [We note strong support!] 14:21:01 zakim, close item 1 14:21:01 agendum 1, TPAC, closed 14:21:02 I see 2 items remaining on the agenda; the next one is 14:21:02 2. Path to SPC/FIDO Integration in Chrome [from Ian] 14:21:13 ACTION: Ian to confirm we will hold an in-person meeting at TPAC 14:21:31 SPC: From browser cache to FIDO/WebAuthn integration 14:21:38 -> https://docs.google.com/document/d/1h6xgrp0Rwe9b3xs3RYgJ-3SJEwqjLP7jRtAc6DmBFbk/edit?pli=1#heading=h.ra69qdn2y337 document 14:22:14 smcgruer_[EST]: I put this together to capture the various complexities in the relationship between SPC and WebAuthen/FIDO. I've charted a path from "current hack" to "good integration" 14:22:32 ...I think a lot of this will involve joint discussions with WebAuthn/FIDO 14:22:47 ...disclosure: this is not a formal plan; these are my thoughts 14:22:55 NickTR: Are you attending FIDO meetings? 14:23:05 smcgruer_[EST]: No; Christiaan Brand representing us 14:23:30 ...there is a pull request out there to add the 3p bit to CTAP; awaiting an outcome there 14:23:56 Ian: What would be the next SPC/WebAuthn steps if that goes well? 14:24:06 smcgruer_[EST]: We'd start to ask the platform authenticators to implement that ability. 14:24:42 ...second track is that there is other behavior currently in SPC that we should move to FIDO: 14:25:07 a) Creation of a credential in a cross-origin iframe; we should ask them to reconsider that capability. Likely contentious but we should start having that conversation. 14:25:52 b) Then we can decide in the WPWG whether we want to start transitioning to allow people to separate the concept of "payment" and "3p payment". 14:26:22 q+ 14:26:26 ack clinton 14:26:40 clinton: I'm trying to understand that distinction. 14:28:31 smcgruer_[EST]: The question is whether a credential can be used (1) only by a relying party in 1p or 3p context versus (2) a non-RP in a 3p context. 14:28:52 ...we need a new term for this 14:32:26 smcgruer_[EST]: Today in a browser-caching world as soon as you create an SPC credential it is usable by a 3p. What my proposal document contains as part of milestone 1....we could separate the capabilities. We could simply create a new extension that allows SPC but only by RP. 14:32:58 ...the real question today is "I would be using SPC but for the 3p usage!" 14:33:05 ...if there's not loud interest today it will be further out 14:34:05 zakim, take up item 3 14:34:05 agendum 3 -- Upcoming meetings -- taken up [from Ian] 14:34:21 Next meeting: 23 June 14:34:24 Please note no meeting on 9 June 14:34:56 Topic: Opt-out (issue 172) 14:34:57 https://github.com/w3c/secure-payment-confirmation/issues/172 14:35:12 smcgruer_[EST]: We've got some ideas behind a flag and experimentation now possible. 14:35:57 ...flag is passed to SPC 14:36:01 ..optional opt-out 14:36:13 ...if the user clicks "opt-out" there's a distinct error value 14:36:30 ..to stop people from doing silent credential matching, there is a notification to the user 14:37:42 clarification: the opt-out button is also available in the "no matching credentials" notification 14:38:11 ....that is, the API caller does not know which UX the user got (1) matching credential (2) no matching credential 14:40:23 Topic: Getting SPC to CR 14:41:00 IJ: What would we need to be able to close 172? 14:41:12 smcgruer_[EST]: Satisfaction with the proposal or saying we don't need anything at all. 14:41:25 ...we also don't have official sign-off yet internally on the proposed approach. 14:41:56 ACTION: smcgruer_[EST] to add to issue 172 that there's an experimental feature and to invite feedback. 14:42:12 https://github.com/w3c/secure-payment-confirmation/issues?q=is%3Aissue+is%3Aopen+-label%3Aafter-v1 14:42:44 q+ 14:42:52 Ian: issue 12. Post v1? 14:43:46 smcgruer_[EST]: I would like to see this post v1 from SPC POV. I think that FIDO folks are thinking that where browser knows about an authenticator we have all the bits in place. But it's non trivial complexity from an SPC spec perspective 14:44:22 ACTION: Ian to work with Stephen on a pull request to characterize an expectation about roaming authenticator support after v1 14:46:19 Ian: What about 154? Is that mostly for WebAuthn folks? 14:47:04 Ian: Can we close 157 if the CTAP bit lands? 14:47:40 smcgruer_[EST]: the bit landing won't make it work; there's more to do on the CTAP side (years)...in other words...there's a long path 14:48:49 q+ 14:49:01 ack smcgruer_[EST] 14:49:27 smcgruer_[EST]: Do the chairs have a concept of what the CR version of SPC will look like? 14:50:00 ...e.g., no browser caching before CR? 14:50:30 ACTION: Ian to work with Chairs to describe the desired state of the specification at CR 14:50:52 smcgruer_[EST]: My personal aspiration is to have a specification that we can get to Rec with 2 implementations 14:51:07 ^ --- wasnt me 14:51:25 s/smcgruer_[EST]: My personal aspiration/NickTR: My personal aspiration 14:51:38 nicktr: I don't know what that implies for browser cacheing. 14:51:58 ..I also have some queasiness regarding SPC-as-payment-method 14:52:08 q+ 14:52:24 NickTR: ...but broadly, if we feel we can get it over the line, that would be a helpful signal to people, I'd be satisfied 14:52:27 ack smcgruer_[EST] 14:52:43 smcgruer_[EST]: Very good answer. I think then there are two questions 14:53:03 1) First there is the experience of a Web developer trying to use the API. The question there is "if I use this thing will it change on me in 1 year?" 14:53:24 ...that's a great question that includes both the PR API question, but also the powers of 3p v 1p usage. 14:53:48 2) The implementer base (browsers) 14:54:25 ...there, aside from their interest, I wonder what the concrete steps needed are. For example, platform-level support may or may not be required. 14:55:41 q? 14:57:31 RRSAGENT, make minutes 14:57:31 I have made the request to generate https://www.w3.org/2022/05/26-wpwg-minutes.html Ian 14:57:41 RRSAGENT, set logs public