15:49:19 <RRSAgent> RRSAgent has joined #webauthn
15:49:19 <RRSAgent> logging to https://www.w3.org/2022/06/09-webauthn-irc
15:49:21 <Zakim> RRSAgent, make logs Public
15:49:22 <Zakim> Meeting: Web Authentication WG
15:59:39 <jfontana> jfontana has joined #webauthn
16:00:38 <jfontana> invite rrsagent
16:02:13 <jfontana> rrsagent, make logs public
16:04:52 <wseltzer> present+ Tim_Cappalli, Tony_Nadalin, Joseph_Vasterling, Dirk_Balfanz, Arnar_Birgisson, Emil_Lundberg, John_Fontana, Armen_Anoyan, Adam_Langley, John_Bradley, Shane_Weeden, Nick_Steele, Wendy_Seltzer
16:05:08 <wseltzer> present+ Matthew_Miller
16:05:28 <elundberg> elundberg has joined #webauthn
16:05:32 <elundberg> present+
16:05:44 <sbweeden> sbweeden has joined #webauthn
16:05:47 <wseltzer> Meeting: WebAuthn F2F
16:07:33 <wseltzer> present+ Mike_Jones
16:07:53 <Arnar> Arnar has joined #webauthn
16:08:20 <matthewmiller> matthewmiller has joined #webauthn
16:08:22 <jfontana> Guest: Joseph Vasterling - Best Buy
16:08:44 <wseltzer> regrets+ dveditz
16:11:11 <wseltzer> Topic: WebAuthn @ Best Buy
16:11:25 <wseltzer> [presentation from Joe Vasterling]
16:11:30 <jfontana> joseph: what is best buy doing around web authn
16:11:41 <jfontana> Best Buy
16:12:00 <jfontana> ...will give us high level overview.
16:12:11 <kaiju> kaiju has joined #webauthn
16:12:28 <jfontana> ...customer authentication is key for us.
16:12:51 <jfontana> ...security for customer is key, secure as possible, with a lot of challenges.
16:12:59 <jfontana> ...security vs. friction
16:13:07 <jfontana> ...we are customer obsessed
16:13:29 <jfontana> ...more customer interaction is the goal and to drive addtional security
16:14:15 <jfontana> ...we rolled out Webauthn on large screen experience
16:14:30 <wseltzer> present+ Martin_Kreichgauer
16:14:43 <jfontana> ...credential selection is first step.
16:14:52 <jfontana> ...ties credential to webauthn process
16:15:16 <jfontana> ...user gets to recognized state and thenm prompted for credential
16:17:07 <jfontana> ...works with chrome and firefox
16:17:20 <jfontana> shane: do you filter for other platforms
16:18:07 <jfontana> joseph: I don't think we are asking for attestation.
16:18:40 <jfontana> joseph: we are working on the feedback loop
16:18:51 <jfontana> ...we do surveys on bestbuy.com site.
16:19:04 <jfontana> Andrew: we created UX guidelines.
16:19:11 <jfontana> ...did you look at those.
16:19:29 <wseltzer> present+ Andrew_Shikiar
16:19:31 <jfontana> joseph: it seemed confusing at times
16:19:45 <jfontana> ...they seaid the spec was confusing to them
16:20:03 <jfontana> ...they struggled on their own, trying to give feedback
16:20:28 <jfontana> A.Shikiar: I will send you the UX work that we have done.
16:20:39 <jfontana> joseph: I will take a look
16:20:52 <jfontana> tony: what is update?
16:21:20 <jfontana> joseph: it is light. we are trying to help customers through the  authentication process
16:21:31 <jfontana> ...we don't know yet what to call the button for authentication
16:21:41 <jfontana> ...we would like more traffic.
16:22:01 <jfontana> Matt: how did you think about the security
16:22:40 <jfontana> joseph: we do see people in channel and account takeover , trying to help security here
16:23:07 <jfontana> ...we discovered webauthn, but we are exploring all options
16:23:28 <jfontana> NickS: were you doing any testing, conformance test
16:23:37 <jfontana> joseph: I will take that back.
16:24:12 <jfontana> matt: as a consumer I was happy to see the options
16:24:31 <jfontana> joseph: as you work on this, fraud is a big issue.
16:24:40 <jfontana> ...so we want good authentication.
16:25:40 <jfontana> shane: on account take over. pre-webauthn you could force multifactor to you do that
16:25:49 <jfontana> joseph: we see some success here.
16:25:54 <wseltzer> wseltzer has changed the topic to: 9 June F2F https://www.w3.org/events/meetings/53cc9a2e-c2fe-4a2a-81b0-314c39463969
16:26:00 <jfontana> ...it is compulsory
16:27:22 <jfontana> joseph: we do look at payments, no looking at the flow. more about how to control the flow
16:27:43 <jfontana> bradley: you are part of the risk analysis, this is for payments
16:27:51 <jfontana> agl: have you seen passkeys
16:28:02 <jfontana> joseph: no
16:29:20 <jfontana> joseph: we have not removed the log-in; once they do the initial credential we can take away log-in
16:29:38 <jfontana> ...we are using surveys and tools for feedback on WebAuthn
16:31:24 <jfontana> Andrew Shikiar: <lost audio>
16:31:33 <jfontana> ...we need to iterate passkeys
16:31:39 <jfontana> ...that is based on testing
16:31:41 <arnar> arnar has joined #webauthn
16:31:54 <jfontana> getting that feedback to FIDO
16:31:59 <jfontana> ...want to gather all we can
16:32:04 <jfontana> ...it shows future directions
16:32:26 <jfontana> ...w3c and FIDO there is overlap, we want to support the Adoption Community Group
16:32:43 <jfontana> ...web authn and FIDO  is a close working relationshiop
16:33:12 <jfontana> ...one goald for FIDO was to enable libraries
16:33:18 <jfontana> ...want to see that take place.
16:33:32 <jfontana> tony: where does PassKey going
16:33:47 <jfontana> andrew: I hear alot about it
16:34:12 <jfontana> ...taking a lot out of play
16:34:21 <wseltzer> s/a lot/passwords/
16:34:29 <jfontana> ...would be interesting to see how enterprise goes.
16:34:52 <jfontana> ...I think the security key is the gold standard
16:35:17 <jfontana> tony: one of your principals is impacted
16:35:40 <jfontana> ...we need to see how enterprise goes.
16:35:58 <jfontana> bradley: passkeys will work with Level 2 certification
16:36:12 <jfontana> ...passkeys are not being standardized
16:36:36 <jfontana> Tim: we need to see it as a credential type
16:36:47 <jfontana> ...it needs to be generic.
16:37:11 <jfontana> ...there is not a threat here. there is not a spec called passkeys
16:37:31 <jfontana> Nick: it is coming out like it is different keys
16:38:17 <jfontana> matt: enterprise is losing the controls on the security model
16:38:19 <jfontana> shane: yes.
16:38:23 <wseltzer> agenda+ enterprise RP use cases (Matt_Miller)
16:38:41 <jfontana> bradley: we should talk about multi-device creds, which is just one piece.
16:38:53 <jfontana> matt: enerprise RPs asking about passkeys.
16:39:10 <selfissued> selfissued has joined #webauthn
16:39:17 <selfissued> present+
16:39:32 <jfontana> shane: challege for platform providers, enterprise is not set to adopt this right now
16:39:52 <jfontana> ...some of the model is out of sequence.
16:40:13 <kaiju> kaiju has joined #webauthn
16:40:43 <wseltzer> Topic: TPAC
16:40:46 <jfontana> tony: one thing to bring up is TPAC
16:40:50 <nsteele> present+
16:41:09 <jfontana> ...request to meet with anti-fraud and payments people
16:41:19 <jfontana> ...TPAC is end of September
16:41:37 <wseltzer> [12-16 September]
16:41:40 <jfontana> wendy: 12-16 September
16:43:34 <jfontana> tnoy: so we will be there; meet with payments, privacy and anti-fraud fols,
16:43:57 <wseltzer> agenda+ PRs
16:44:13 <jfontana> tony:  look at some PRs and some details, then go to Christiaan  when he gets here.
16:45:32 <wseltzer> zakim, take up agendum 3
16:45:32 <Zakim> agendum 3 -- PRs -- taken up [from wseltzer]
16:48:30 <nsteele> nsteele has joined #webauthn
16:49:32 <wseltzer> present+ John_Pascoe, David_Waite
16:49:42 <jfontana> tony: let's go to open issues.
16:51:28 <jfontana> https://github.com/w3c/webauthn/pull/1733
16:51:40 <wseltzer> https://github.com/w3c/webauthn/issues/1731
16:52:03 <jfontana> elundberg: adds some things we may not want to do as an RP
16:52:14 <jfontana> ...I encourage review and feedback
16:52:40 <jfontana> Tim: maybe do this after the Ping presentation
16:53:31 <jfontana> DWaite: there will be Ping ID presentation. point is that FIDO does not protect against supply chain attacks
16:54:08 <jfontana> elundberg: issue with unstreded sub-domains.
16:54:37 <elundberg> s/unstreded/untrusted code on/
16:54:49 <jfontana> tony: Nick has this come up with adoption group
16:54:55 <jfontana> nicK: not really
16:55:26 <jfontana> bradly: Token Binding would have made this easier...
16:55:52 <jfontana> https://github.com/w3c/webauthn/pull/1732
16:56:00 <jfontana> agl: no changes
16:56:24 <jfontana> tony: move forward with this one.
16:57:19 <jfontana> tony: will circle back
16:57:44 <jfontana> https://github.com/w3c/webauthn/pull/1703
16:58:17 <jfontana> matt: trying to figure this one out; could use a working session and push this through
16:58:24 <wseltzer> agenda+ pr1703, JSON (de)serialization
16:58:27 <jfontana> agL: I want to see this defined and lander
16:58:31 <jfontana> ...landed
16:58:51 <jfontana> martin: in reasonable shape, some open areas.
16:59:16 <jfontana> ...another one is about structure of IDL
16:59:28 <jfontana> agl: this is not a web api.
16:59:49 <jfontana> ...it does not have to follow all the IDL
17:00:31 <jfontana> matt: write as vaild IDL, but not restricted compoents
17:00:39 <jfontana> martin: should still be valid IDL
17:00:49 <jfontana> agl: there are no binding.
17:00:55 <jfontana> ...tooling does not have to process.
17:01:02 <jfontana> ...it is only humans will ever read this
17:01:18 <jfontana>  bradly: but Mozilla has rules around this.
17:01:39 <jfontana> agl: this is mostly for developers
17:02:08 <jfontana> agl: should we delete IDL
17:02:35 <jfontana> martin: it is probably best to leave it in
17:03:09 <jfontana> elundberg: could we do this a different way in public key creation
17:04:37 <jfontana> eluncberg: you have add jason
17:04:57 <jfontana> ...json
17:06:56 <jfontana> agl: martin thinks we need to have it in.
17:07:09 <jfontana> ...elundberg is this fundamental in PR
17:07:48 <jfontana> elundberg: maybe we should be more rigorous, but willing to let some things go
17:08:03 <jfontana> matt: should be leave something for other browser developers
17:08:20 <jfontana> elunberg: mostly tweaks here, not so for fundamentals
17:08:28 <jfontana> matt: I will close this out.
17:08:42 <jfontana> martin: I can try to do this in a prototyple.
17:09:27 <jfontana> elunberg: I thnk of down stream we should be fine.
17:12:28 <jfontana> martin: we should look at processing
17:12:51 <jfontana> selfissue: think you will find all that in the registry
17:15:39 <jfontana> agl: work assigned to work toward closing this
17:15:59 <wseltzer> zakim, drop agendum 4
17:15:59 <Zakim> agendum 4, pr1703, JSON (de)serialization, dropped
17:16:35 <wseltzer> [break, 10 minutes]
17:19:45 <nsteele> nsteele has joined #webauthn
17:26:58 <wseltzer> [resuming]
17:27:08 <jfontana> https://github.com/w3c/webauthn/pull/1695
17:27:13 <jfontana> aggl: we shold merge
17:27:27 <wseltzer> present+ Akshay_Kumar
17:27:30 <jfontana> tony: merge
17:27:47 <jfontana> tony: emil can you look at this one.
17:28:52 <jfontana> self-issue: I am approving now
17:29:55 <jfontana> tony: any objections?
17:30:02 <jfontana> tony: no
17:31:40 <jfontana> elundberg: mostly editorial, the rest we can approve
17:32:24 <jfontana> tony: merged
17:33:34 <jfontana> https://github.com/w3c/webauthn/pull/1663
17:33:35 <wseltzer> https://github.com/w3c/webauthn/pull/1663
17:34:05 <jfontana> agl: adds second key to given credential, android expects to support with when go public with passkeys
17:36:25 <jfontana> bradley: missing in CTAP a notion of attestation type
17:37:19 <jfontana> ...we may want to have a certain attestation type; or Post Quantum , want to allow RP to have attestation  types
17:37:30 <jfontana> ...may be useful at CTAP layer to say more.
17:37:48 <jfontana> ...I would like to fix is properly at CTAP level
17:38:29 <jfontana> ...lets not do it as a one off
17:38:42 <jfontana> ...would have to add flags to get attestations
17:39:07 <jfontana> agl: how to we express at aweb authn level
17:39:35 <jfontana> bradley: sort of already have a mapping
17:39:55 <jfontana> agl: you want attestations and types
17:40:08 <jfontana> bradley: will give us some room down the road to fill in gaps
17:40:53 <jfontana> ...I would like to have RP options without blowing up things later in Post Quantum
17:41:27 <jfontana> ...what do we want to do with multi-device creds.
17:42:01 <jfontana> ...DPK, not multi-device cres
17:42:15 <jfontana> ...Device Public Key
17:43:26 <jfontana> agl: DPK opens up some things we don't like
17:44:15 <jfontana> shane: this is going away from my question
17:44:47 <jfontana> ...what is risk of not support DPK as primary credentials
17:45:07 <jfontana> agl: we don't want to make this a smooth operation
17:47:01 <jfontana> ....check that, we want this to be a smooth operation
17:50:16 <jfontana> self-issue: how do we make this actionable
17:50:50 <jfontana> bradley: change proposed taking over entire cryto-gram
17:51:14 <jfontana> ...there is not an issue for this yet
17:51:44 <jfontana> ...only question is to do this in way that will not impact existing RPs
17:52:13 <jfontana> ...there are things that may go beyond the RP.
17:52:59 <jfontana> self-issue:
17:53:23 <jfontana> ...defers
17:55:03 <jfontana> agl: are we changing this out , and an unsigned output?
17:55:17 <jfontana> dirk: DPK choose to make use of this.
17:55:46 <jfontana> agL: this should not break anything.
17:56:26 <jfontana> akshay: what will the main key signed in this case.
17:56:49 <jfontana> agl: both will be signed. one normal one unsigned over the authenticator data
17:57:18 <jfontana> dirk: how does attestation work then>
17:57:42 <jfontana> agl: new fields in CTAP2, it will control attestation and normal attestation.
18:03:37 <nsteele> nsteele has joined #webauthn
18:08:56 <wseltzer> present+ Pamela_Dingle
18:12:59 <jfontana> agl: I think the DPK stays in the extension
18:14:00 <jfontana> shane: enterprise need a way to deal with cloud ???
18:15:05 <jfontana> agl: we want to make a clear path for DPK
18:16:18 <jfontana> shane: give me a device bound cred, DPK is a hard way to express this.
18:27:23 <arnar> arnar has joined #webauthn
18:27:47 <jfontana> bradley:  difference this makes RP, can get attestation without DPK
18:28:03 <jfontana> ...should authenticators return it RPs could do it.
18:29:10 <jfontana> tony: any objections of returning DPK
18:29:32 <jfontana> agl: we are not breaking it.
18:30:19 <nsteele> nsteele has joined #webauthn
18:30:30 <jfontana> agl: apple is getting rid of passwords...
18:31:32 <jfontana> shane: if no attesation for the DPK, then it is nearly useless
18:31:51 <jfontana> bradely: we have to nail this down.
18:32:08 <jfontana> agl: RP won't get attestation this year
18:42:27 <nsteele> nsteele has joined #webauthn
18:42:49 <nsteele> nsteele has joined #webauthn
18:45:10 <nsteele> nsteele has joined #webauthn
18:47:30 <jfontana> agl: I will write a PR on this.
18:47:39 <nsteele> nsteele has joined #webauthn
18:47:41 <wseltzer> zakim, remind us in 13 minutes
18:47:41 <Zakim> ok, wseltzer
18:47:51 <wseltzer> [lunch break, 13 minutes]
19:00:42 <Zakim> wseltzer, you asked to be reminded at this time
19:02:01 <wseltzer> [returning]
19:02:09 <nsteele> nsteele has joined #webauthn
19:04:44 <wseltzer> Topic: Demo
19:05:36 <wseltzer> [Christiaan shows a passkey demo]
19:13:11 <jfontana> end of demo
19:13:56 <jfontana> matt: does this use conditional UI
19:14:10 <jfontana> Christiaan: yes
19:22:51 <nsteele> nsteele has joined #webauthn
19:27:40 <sbweeden> sbweeden has joined #webauthn
19:29:44 <wseltzer> https://github.com/w3c/webauthn/pull/1576
19:29:52 <wseltzer> Topic: Back to PRs
19:30:07 <wseltzer> nina: I also have to send updates to HTML
19:30:19 <wseltzer> ... we could merge with a note that HTML updates are also needed
19:30:49 <wseltzer> ... I haven't yet opened an issue in HTML to avoid circular dependency
19:31:09 <wseltzer> tony: Can you open an issue or PR there for tracking here?
19:31:19 <wseltzer> nina: yes
19:31:56 <wseltzer> ... and 1576 is ready to merge from my perspective
19:32:36 <wseltzer> john: Should timeouts be respected?
19:32:44 <wseltzer> nina: called out recommend avoid setting timeouts
19:33:30 <wseltzer> john: @@
19:33:39 <wseltzer> nina: when you cancel the request, we don't resolve the promise
19:33:51 <wseltzer> ... so we're not signaling that user has credential but chooses not to use it
19:34:13 <wseltzer> ... webauthn without conditional UI can show error because it's the same error as timeout
19:34:25 <nsteele> nsteele has joined #webauthn
19:34:30 <jfontana> Do you need me to take over
19:34:34 <jfontana> wendy
19:35:22 <jfontana> * jfontana can you take the next 10 minutes?
19:35:46 <wseltzer> matthew_miller: what if you keep changing focus to and from the username field, does it prompt every time?
19:35:55 <wseltzer> nina: I think it should be every time
19:36:10 <wseltzer> ... though it could be a more subtle indicator on subsequent visits
19:36:19 <wseltzer> s/visits/focus/
19:36:44 <wseltzer> matthew: there could be implementation variations
19:36:50 <wseltzer> tim: as there are for password
19:37:14 <wseltzer> tony: so you'll update and we'll discuss at next meeting
19:37:25 <wseltzer> tony: 1425, recovery extension?
19:37:31 <wseltzer> elundberg: nothing new
19:37:50 <wseltzer> tony: 1736
19:38:03 <wseltzer> https://github.com/w3c/webauthn/pull/1736
19:38:08 <wseltzer> elundberg: looks ready to go
19:38:16 <wseltzer> tony: any objections?
19:38:32 <wseltzer> ... merge
19:39:15 <wseltzer> tony: 1741, did we resolve?
19:40:25 <wseltzer> john_bradley: related to DPK, PRs in CTAP
19:40:30 <wseltzer> tony: 1740
19:40:53 <wseltzer> elundberg: some editorial fixes
19:41:18 <wseltzer> ... I'll create the PR
19:41:22 <wseltzer> tony: 1739
19:42:29 <wseltzer> (returning to that one)
19:42:34 <wseltzer> tony: 1738
19:43:47 <wseltzer> john_bradley: how can we add flexibility, so it doesn't blow up browser
19:44:22 <wseltzer> sbweeden: other examples where we deal with fingerprinting surface, compat?
19:44:39 <wseltzer> ... e.g. getWebauthnLevel
19:45:11 <wseltzer> tim: could you follow sec client hints ?
19:45:59 <matthewmiller> matthewmiller has joined #webauthn
19:46:10 <jfontana> * jfontana Wendy I can take over
19:47:36 <jfontana> nina: ok upgrading to chrome.
19:48:22 <jfontana> ...I am OK the caveat is this is not  silver buller
19:48:27 <jfontana> ...bullet
19:49:52 <jfontana> bradley: how does microsoft feel on enum issues
19:50:25 <nsteele> nsteele has joined #webauthn
19:50:58 <jfontana> agl: we don't fall back to direct
19:51:04 <jfontana> ...set enterprise.
19:51:23 <jfontana> Bradley: that is good point
19:51:41 <jfontana> bradley: default is better than blowing up.
19:52:09 <jfontana> ...should it return a type error
19:52:25 <jfontana> matt: we do that an act accordingly and go to an alternative
19:52:42 <jfontana> agl: we have to have one rule
19:53:04 <jfontana> bradley: you can't no what it is before you get it
19:53:57 <jfontana> bradley: needs some feature detection
19:54:14 <jfontana> agl: we need ignore as a default
19:54:29 <jfontana> self-issue: who will file browser bugs?
19:54:59 <jfontana> nina: maybe we want to discover if enterprise attestation is supported or not
19:55:06 <jfontana> ...I will file bugs
19:55:13 <jfontana> tony: this has to be made clear in spec
19:55:35 <jfontana> bradely: it ignores some browser options
19:56:17 <jfontana> self-issue: lets not go to versioning
19:56:59 <jfontana> agl: do RPs what attestation flag
19:57:24 <jfontana> bradley: we need dom string, ignore ??
19:58:28 <selfissued> selfissued has joined #webauthn
19:58:32 <nsteele> nsteele has joined #webauthn
19:58:34 <selfissued> present+
19:58:43 <selfissued> https://github.com/w3c/webauthn/issues/1738#issuecomment-1151561722
20:00:32 <jfontana> tony: nina you will update
20:00:40 <jfontana> nina: which way are we going
20:01:26 <jfontana> agl: don't need feature flag for attestation and we want to change the dom string
20:02:04 <jfontana> nona: I filed an issue for the attestation feature
20:02:12 <jfontana> tony: so you can finish issue
20:02:14 <wseltzer> s/nona/nina/
20:03:21 <jfontana> tim: #1739
20:03:36 <jfontana> tim: we can to mediated UI
20:03:37 <matthewmiller> https://github.com/w3c/webauthn/pull/1576
20:03:43 <wseltzer> rrsagent, draft minutes
20:03:43 <RRSAgent> I have made the request to generate https://www.w3.org/2022/06/09-webauthn-minutes.html wseltzer
20:04:24 <wseltzer> chair: Nadalin, Fontana
20:04:55 <wseltzer> i|Back to PRs|scribenick: wseltzer
20:05:37 <wseltzer> rrsagent, draft minutes
20:05:37 <RRSAgent> I have made the request to generate https://www.w3.org/2022/06/09-webauthn-minutes.html wseltzer
20:05:49 <jfontana> tony: we are through the un-triaged
20:06:11 <wseltzer> i|sec client hints|scribenick: jfontana
20:06:38 <wseltzer> i|Guest: Joseph Vasterling - Best Buy|scribenick: jfontana|
20:06:43 <wseltzer> rrsagent, draft minutes
20:06:43 <RRSAgent> I have made the request to generate https://www.w3.org/2022/06/09-webauthn-minutes.html wseltzer
20:07:17 <jfontana> tim: closed #1708
20:07:59 <jfontana> tony: RP use cases
20:08:10 <jfontana> ...this is a discussion
20:09:18 <wseltzer> Topic: RP Use Cases
20:09:23 <jfontana> Matt: Cisco looking at sync across devices
20:09:40 <jfontana> ...this was ideal for use, being shared - less ideal
20:09:49 <jfontana> ...we thought it would still be bound to user
20:09:58 <jfontana> ...now we see sharing keys.
20:10:41 <jfontana> ...now we have cred does not indicate specific devices or users.
20:10:54 <jfontana> ...there is lack of configure with web authn and new keys
20:11:12 <jfontana> ...what are RP pain points.
20:11:37 <jfontana> ...if opt out, people will do that. but we need to have them
20:12:12 <jfontana> ...passkeys will come out way before DPK what happens then?
20:12:43 <jfontana> shane: there is going to be awful second factors as people ignore passkeys
20:13:16 <jfontana> matt: need to hedge capability of passkey, we could sell other products, but we shouldn't have to take those extra steps
20:13:43 <jfontana> ...I think we should double down on the frustrations of RPs
20:14:24 <jfontana> matt: the reason we stopped attestation was a consideration
20:14:33 <jfontana> ...it will be a negative when we have that conversation,
20:14:51 <jfontana> bradley: your beef is with multi-credentials
20:15:03 <jfontana> ...we need to be clear on the terminology
20:15:37 <jfontana> ...matt your problem is not with multi creds.
20:15:55 <jfontana> matt: in this moment there are features we have issues with
20:16:17 <jfontana> matt: you have two things hybrid and flags
20:16:26 <jfontana> ...we are not ready to support this
20:16:42 <jfontana> tim: we all get support cases
20:17:40 <jfontana> agl: does this thinking include security key for employees
20:18:09 <jfontana> ...if we put this behind enterprise flag it is useless to you (microsoft)
20:19:00 <jfontana> matt: manage device policy is not going to work for us.
20:19:16 <jfontana> tim: same answers across all these areas
20:20:08 <jfontana> matt: we had security keys and now we had to adapt to cable
20:20:25 <jfontana> ...these are things we need ahead of time. we would have opted out
20:20:46 <jfontana> Christiaan: this will stablize over time
20:21:12 <jfontana> ...can we give people an opt-out? when everything is there it will go forward
20:21:30 <jfontana> matt: this will repeat itself with evolution and new featuers
20:21:49 <jfontana> ...what if we have different mentality on roll outs
20:22:28 <jfontana> Christiaan: longer term concern. we will focus on consumer, having a key will be  unsettling for them
20:22:59 <jfontana> bradley: some browsers do a better job than others. there are things we can do.
20:23:47 <jfontana> matt: not just authentication experience, we have authorization
20:25:30 <jfontana> Christiaan: we might want to spell out some things more specifically.
20:26:24 <jfontana> shane: we always needed attestation. why can't we do that
20:27:02 <jfontana> Christiaan: so you can simply not offer  anything.
20:27:34 <jfontana> Shane: on issue to wait on signal. At the end, I say tough
20:27:50 <jfontana> bradley: cable does not tell you what is coming.
20:27:55 <jfontana> ...user agent does not help
20:28:49 <jfontana> Christiaan: there are plenty of times you want an Apple platform.
20:28:59 <jfontana> shane: but you don't get an attestation.
20:29:17 <elundberg> s/want an Apple/want to know the authnr is an Apple/
20:29:17 <jfontana> Matt: could we add a simple flag to registration
20:31:08 <jfontana> matt: we are working with a staggered roll out
20:31:25 <jfontana> shane: we will have windows where we will shut down WebAuthn
20:32:06 <jfontana> bradley: is there some attestation where we could offer?
20:34:23 <jfontana> tim: we mapped a user on a device and now it means nothing
20:34:56 <jfontana> Christiaan: there is still a value to passkeys
20:35:03 <jfontana> ...consumer enterrpise
20:39:05 <jfontana> tim: we are evangelizing a new passkey for enrollment
20:39:24 <jfontana> ...but now it is credential sharing
20:40:05 <jfontana> tony: this is a choice for people.
20:40:58 <jfontana> wendy: should we go back to security modeling.
20:41:21 <jfontana> ...as the technology is out there , use cases are overlayed
20:42:12 <jfontana> matt: we were just getting used to credential sharing, and then this is coming was
20:42:36 <jfontana> John (Apple): these are looked at as better than passwords.
20:42:44 <jfontana> ...it was password replacement
20:42:58 <jfontana> tim: what precedent we are trying to do.
20:43:17 <jfontana> ...we say credential sharing is coming
20:50:29 <jfontana> jfontana has joined #webauthn
20:51:07 <wseltzer> scribe+
20:51:07 <jfontana> shane: I don't want user to go through ceremony that the RP knows will not work
20:52:06 <cnh> cnh has joined #webauthn
20:52:59 <jfontana> agl: I don't understand going back to RP
20:53:26 <jfontana> shane; It is more of having the authenticator not being able to fail as an outcome.
20:53:33 <jfontana> ...get the correct credential
20:54:04 <jfontana> ...I want the RP to be asked for a credential
20:55:01 <jfontana> bradley: this is more like a transport hint.
20:55:54 <jfontana> shane: capture the issue
20:56:24 <jfontana> dirk: why does this not meet the requirement on DPK?
20:56:39 <jfontana> christiaan: you can go back if you want
20:56:53 <jfontana> bradley: DPK is suppose to fail. you can't error out.
20:57:05 <jfontana> ...i don;t know that all RPs will want that behavior
20:57:59 <jfontana> matt: here is my ask. if we can't have device bound cred, can we ask for a credential to be permanently bound
20:58:10 <jfontana> shane: sounds like a path to distruction
20:58:32 <jfontana> Christiaan: I see future, we allow mulitplel vendors to plug in
20:58:51 <jfontana> ...put all of these passwords will have different ways to share, get back into account.
20:59:09 <jfontana> ...this is why we have attestation, we can go down multiple paths.
20:59:22 <jfontana> ...now we come back to meta data.
20:59:42 <jfontana> shane: mds will describe what these things are
21:00:19 <jfontana> dirk: maybe requirement is identifying a kind of passkey
21:03:52 <jfontana> dirk: maybe it is not the sharing, but the capabilities
21:07:20 <jfontana> elundberg: main argument against it is don't want a flag, don't want user to turn on better secruity.
21:11:45 <jfontana> shane: I have problem that is out of the RP's control to ask for a specific thing
21:12:04 <jfontana> elundberg: notw that we have flags it makes sense to have tihs parament on the top level.
21:12:29 <jfontana> s/this parameter/
21:13:34 <jfontana> Matt: trying to preserve the device bound,
21:13:45 <wseltzer> s/parament/parameter/
21:18:08 <jfontana> matt: I want a fail if the credential is going to fail
21:18:25 <jfontana> agl: I am listening
21:19:41 <jfontana> shane: i don't care the answer, I wants to make this request of the client
21:20:10 <jfontana> s/I want/
21:22:57 <jfontana> s/wants/want
21:23:31 <jfontana> tony: we have to show the implementation of the spec. in order to go to Recommendation
21:23:53 <jfontana> ...you could play with features
21:24:42 <jfontana> ...but it has to have implementation to have spec
21:27:57 <jfontana> bradley: RPs will have to decide what they are going to reject.
21:28:42 <jfontana> christiaan: we have to see how tis shakes out.
21:34:15 <jfontana> bradley: we have strong authentication, is it multiple factor? It is strong single factor. It could be part of an AAL 2, and be multi factor
21:34:42 <jfontana> ...we are changing the underlying rules
21:35:02 <jfontana> matt: is this a message going out, you want to consider a second factor
21:35:11 <jfontana> bradley: depends on your  use case.
21:48:24 <wseltzer> [10 min break]
21:49:02 <nsteele> nsteele has joined #webauthn
21:49:28 <matthewmiller> matthewmiller has joined #webauthn
21:53:32 <nsteele> nsteele has joined #webauthn
21:54:36 <nsteele_> nsteele_ has joined #webauthn
22:06:50 <selfissued> selfissued has joined #webauthn
22:07:00 <selfissued> present+
22:10:15 <jfontana> tony: would like to have a draft WD-01
22:11:27 <sbweeden> sbweeden has joined #webauthn
22:11:49 <jfontana> ...put out a draft before TPAC
22:12:26 <jfontana> self-issue: do we have the people who can use the tooling?
22:13:27 <wseltzer> action: wseltzer to do some repository cleanup
22:13:36 <jfontana> wendy: she can offer help from W3C
22:13:58 <jfontana> tony: any more issues to talk about?
22:14:03 <jfontana> ...SPC?
22:15:38 <jfontana> C
22:16:40 <wseltzer> Topic: SPC
22:18:58 <wseltzer> [Christiaan describes the SPC argument for non-iframe cross-origin get of credential]
22:20:27 <wseltzer> christiaan: can we allow the creation of a webauthn credential in a cross-origin iframe?
22:23:47 <wseltzer> jbradley: should we take this on?
22:24:04 <wseltzer> ... admit that you can make a credential in a cross-origin iframe
22:24:11 <wseltzer> ... which will make many IDPs happy
22:24:37 <wseltzer> christiaan: can you write an issue?
22:24:40 <wseltzer> jbradley: yes
22:25:18 <wseltzer> christiaan: we also keep hearing about generic things people want signed...
22:25:31 <wseltzer> selfissued: there's an unimplemented extension
22:26:40 <wseltzer> agl: do users understand who is speaking is a big concern
22:35:27 <wseltzer> agl: you navigate to example.com, get a foo.com iframe that can make a foo.com credential, that can be used on example.com
22:35:45 <wseltzer> jbradley: make in 3d party context iframe
22:35:58 <wseltzer> agl: make in ifrme that is not same-origin with ancestors
22:36:13 <wseltzer> tony: Any other issues?
22:37:03 <wseltzer> sbweeden: thanks for the conversation about the needs of enterprise
22:37:55 <wseltzer> matthewmiller: what we're telling RPs, DPK is coming and will eventually be able to achieve the properties that had been assumed
22:38:07 <wseltzer> ... no short-term mitigation
22:38:19 <wseltzer> christiaan: continue to make credentials as usual in Android
22:38:44 <wseltzer> matthewmiller: does apple have a mechanism for opting out?
22:38:53 <wseltzer> johnp: no
22:41:01 <wseltzer> tony: talk with you all in 3 weeks
22:41:29 <wseltzer> ... thanks Tim for hosting
22:41:33 <wseltzer> [adjourned]
22:41:39 <wseltzer> rrsagent, draft minutes
22:41:39 <RRSAgent> I have made the request to generate https://www.w3.org/2022/06/09-webauthn-minutes.html wseltzer
23:25:15 <nsteele> nsteele has joined #webauthn