19:07:46 RRSAgent has joined #webauthn 19:07:51 logging to https://www.w3.org/2023/06/14-webauthn-irc 19:08:08 Zakim, this conference is WebAuthn Bi-Weekly Meeting 7/14 19:08:08 got it, soba 19:08:31 Meeting: WebAuthn Working Group Bi-Weekly 19:08:42 Chair: Tony Nadalin 19:08:48 Scribe: Nick Steele 19:13:01 matthewmiller has joined #webauthn 19:14:54 present+ MikeJones,AckshayKumar,TimCappalli,ShaneWeeden,EmilLundberg,JohnPascoe,DavidTurner,JamesZhang,AndersAberg,JohnBradley 19:15:08 TOPIC: PR Discussion 19:15:26 Discussing https://github.com/w3c/webauthn/pull/1901 19:16:09 Tim framing the problem: The current developer guidance to relying parties for whether they can offer passkeys to users is to call isUVPAA() and isConditionalMediationAvailable(). One returns a boolean, the other a promise. This is already complex . This also doesn't tell the whole story. 19:16:25 Shane: These two methods both return a boolean now 19:17:25 John: What do browsers think about this? Is this going to be gated across Firefox and other platforms? Is this going to be a dynamic value? how can isPasskeyPlatformAuthenticatorAvailable() be changed by the platform and client? 19:17:42 Tim: User should be able to remediate 19:18:07 MattM: This could be difficult for an RP, where we might want to provide steps for remediation 19:18:24 Tim: Anything a user can fix on their own will be prompted by the client device 19:19:09 MattM: we haven't seen this out in the wild all the time. ex: Chrome asks to enable bluetooth only once, but if disallowed, there is no further prompt and remediation becomes difficult 19:19:36 Tim: There's a layering problem here where we decide what remediation should be handled where 19:21:27 Nick Steele: this might not be able to pick up platform providers 19:22:03 Tim C: If you're ( a third party provider) intercepting the request (which all are right now) then you should be able to pick up and respond 19:22:21 John: The other way to frame this would be something like isCTAP2RoamingAuthenticatorSupported() 19:22:59 Tim: this doesn't work in a firefox case 19:24:20 Discussion around what types of providers and authenticators would be available to respond true/false to the proposed method 19:25:08 zakim, who's here? 19:25:08 Present: MikeJones, AckshayKumar, TimCappalli, ShaneWeeden, EmilLundberg, JohnPascoe, DavidTurner, JamesZhang, AndersAberg, JohnBradley 19:25:11 On IRC I see matthewmiller, RRSAgent, elundberg, Zakim, steele, ignaloidas, Defluo, smcgruer_[EST], jochen____, Dongwoo, hadleybeeman, sangwhan, slightlyoff, gonzu_15, imlostlmao, 19:25:11 ... Paul, networkException, TimCappalli, sdd, iyobro143, plh, weiler 19:28:42 Discussion around scenarios where a platform passkey authenticator may not be available but there is a synced passkey available 19:29:39 MattM: Cisco currently struggling with 19:30:03 ... webviews that say WebAuthn API are available but error out upon request 19:30:44 Discussion around legacy browsers and webviews where they might be unable to access this information or even make use of passkeys 19:32:17 present+ JasonCai 19:33:01 John: So this may help people when presented with Web Kiosks or versions of Linux that may have versions of CTAP2 19:33:29 Tim agrees this is helpful for public terminal / personal devices flows 19:34:01 MattM: Would we be able to concat isUVPAA and isHybrid into a single call? 19:34:09 Tim: separate PR drafted 19:34:34 MattM: Does this clash with the Hinting proposal posed at the F2F? 19:34:42 Ackshay: diff issue 19:34:48 MattM: there is overlap here 19:35:04 Tim: there are hints provided here 19:35:28 MattM: figuring out how much conflict there is here btwn the two methods 19:35:57 Tim: Emil had many good comments, to respond to them in bulk: 'I agree, but some of this should be a diff PR' 19:36:08 Chair: are you proposing two more? 19:36:47 Tim: Well Firefox had a method along the lines of CTAP2withClientPin() that was fairly valuable, could be worth including, there's two separate sets of verbosity here 19:37:00 Chair: tying to understand how much information we wish to disclose in these methods 19:37:20 Tim: This value is true/false but discloses just as much as isUVPAA() 19:37:25 some disagreement 19:37:52 John et al.: could give one more bit of info than UVPAA 19:38:24 Emil: I have some issue with how the term/spec defines Platform Authenticator 19:39:09 Nick Stele: existing issue in the repo for better defining the current state of Platform Authenticator 19:42:03 Trying to gain consensus on the name and coverage of the method 19:44:21 JohnPascoe: I don't think there's any older platforms [for Apple] that wouldn't be able to support passkeys 19:49:30 Chair tabling discussion on call to move to other open issues 19:49:56 https://github.com/w3c/webauthn/pull/1894 19:50:57 https://github.com/w3c/webauthn/pull/1893 19:51:00 https://github.com/w3c/webauthn/pull/1891 19:51:07 Tim: Waiting on more reviews 19:51:14 ACTION: Adam and John to review https://github.com/w3c/webauthn/pull/1893 19:51:23 woop 19:51:30 ACTION: Adam and John to review https://github.com/w3c/webauthn/pull/1891 NOT https://github.com/w3c/webauthn/pull/1893 19:51:45 https://github.com/w3c/webauthn/pull/1887 19:52:45 MattM Merged 19:53:07 Chair moves to triage open PRs and issues 19:56:23 Discussion around what we want to add before finishing level 3 19:56:55 Discussion around what would occur after working group disbandment 19:57:53 W3C Errata discussion 20:01:37 Zakim, list participants 20:01:37 As of this point the attendees have been MikeJones, AckshayKumar, TimCappalli, ShaneWeeden, EmilLundberg, JohnPascoe, DavidTurner, JamesZhang, AndersAberg, JohnBradley, JasonCai 20:01:42 RRSAgent, make logs public 20:01:46 RRSAgent, generate minutes 20:01:47 I have made the request to generate https://www.w3.org/2023/06/14-webauthn-minutes.html steele 20:01:57 Zakim, bye 20:01:57 leaving. As of this point the attendees have been MikeJones, AckshayKumar, TimCappalli, ShaneWeeden, EmilLundberg, JohnPascoe, DavidTurner, JamesZhang, AndersAberg, JohnBradley, 20:01:57 Zakim has left #webauthn 20:02:00 ... JasonCai 20:02:06 RRSAgent, bye 20:02:06 I see 2 open action items saved in https://www.w3.org/2023/06/14-webauthn-actions.rdf : 20:02:06 ACTION: Adam and John to review https://github.com/w3c/webauthn/pull/1893 [1] 20:02:06 recorded in https://www.w3.org/2023/06/14-webauthn-irc#T19-51-14 20:02:06 ACTION: Adam and John to review https://github.com/w3c/webauthn/pull/1891 NOT https://github.com/w3c/webauthn/pull/1893 [2] 20:02:06 recorded in https://www.w3.org/2023/06/14-webauthn-irc#T19-51-30