07:26:59 <RRSAgent> RRSAgent has joined #wpwg
07:27:03 <RRSAgent> logging to https://www.w3.org/2023/09/11-wpwg-irc
07:27:05 <Gerhard_> Gerhard_ has joined #wpwg
07:27:10 <nicktr> Meeting: Web Payments WG
07:27:22 <nicktr> Agenda: https://github.com/w3c/webpayments/wiki/Agenda-TPAC2023
07:27:29 <nicktr> Chair: Nick TR
07:27:47 <nicktr> Scribe : nicktr, Gerhard_
07:28:01 <nicktr> Scribe: nicktr, Gerhard_
07:33:02 <benoit> benoit has joined #wpwg
07:33:25 <Arman> Arman has joined #wpwg
07:33:36 <Gerhard_> present+ Arman
07:33:45 <Gerhard_> present+ benoit
07:34:23 <Gerhard_> present+ canton
07:34:56 <smcgruer_[EST]> present+ Stephen_McGruer
07:35:07 <smcgruer_[EST]> present+ Helen_Qin
07:35:16 <smcgruer_[EST]> present+ Rick_Byers
07:37:51 <Dingwei> Dingwei has joined #wpwg
07:39:00 <tomasz> tomasz has joined #wpwg
07:39:47 <Sami> Sami has joined #Wpwg
07:39:55 <Sami> Sami has left #wpwg
07:40:27 <JMGirard> JMGirard has joined #wpwg
07:42:35 <nick_s> nick_s has joined #wpwg
07:42:57 <gkok> gkok has joined #wpwg
07:43:03 <SameerT> SameerT has joined #wpwg
07:43:07 <westin> westin has joined #wpwg
07:43:18 <solai> solai has joined #wpwg
07:43:19 <aidanfoley> aidanfoley has joined #wpwg
07:43:30 <sarahob> sarahob has joined #wpwg
07:43:33 <jonathan> jonathan has joined #wpwg
07:43:35 <HelenQin> HelenQin has joined #wpwg
07:43:58 <JeanLuc> JeanLuc has joined #WPWG
07:43:59 <OlivierMaas> OlivierMaas has joined #wpwg
07:44:02 <Adam_> Adam_ has joined #wpwg
07:44:37 <Gerhard_> q+
07:44:39 <fahad> fahad has joined #wpwg
07:44:42 <Peter_> Peter_ has joined #wpwg
07:44:47 <Dingwei_> Dingwei_ has joined #wpwg
07:45:00 <kenneth> kenneth has joined #wpwg
07:45:16 <bryanluo> bryanluo has joined #wpwg
07:45:31 <Bastien> Bastien has joined #WPWG
07:45:34 <Vinoth> Vinoth has joined #wpwg
07:45:35 <smcgruer_[EST]> q+ to offer to scribe when I'm not talking
07:45:36 <smcgruer_[EST]> q?
07:45:51 <benoit> benoit has joined #wpwg
07:45:56 <bfeigel> bfeigel has joined #wpwg
07:45:58 <Gerhard_> q-
07:46:00 <nick_s> q+
07:46:16 <nick_s> q-
07:46:38 <sioked> sioked has joined #wpwg
07:48:18 <Gerhard_> 20 for dinner tonight
07:48:39 <TEngland> TEngland has joined #wpwg
07:48:59 <doug_F> doug_F has joined #wpwg
07:49:26 <smcgruer_[EST]> Agenda: https://github.com/w3c/webpayments/wiki/Agenda-TPAC2023
07:49:42 <Gerhard_> https://w3c.zoom.us/j/88600469011?pwd=SDhRRGhseXgyd1BCcUlBRHZWTEZ0UT09
07:49:46 <Gerhard_> Meeting details
07:49:46 <Sami> Sami has joined #wpwg
07:50:29 <nicktr> zakim, who is here?
07:50:29 <Zakim> Present: Arman, benoit, canton, Stephen_McGruer, Helen_Qin, Rick_Byers
07:50:31 <Zakim> On IRC I see Sami, doug_F, TEngland, sioked, bfeigel, benoit, Vinoth, Bastien, bryanluo, kenneth, Dingwei_, Peter_, fahad, Adam_, OlivierMaas, JeanLuc, HelenQin, jonathan, sarahob,
07:50:31 <Zakim> ... aidanfoley, solai, westin, SameerT, gkok, nick_s, JMGirard, tomasz, Gerhard_, RRSAgent, Zakim, hari, tminamii, pea1358, canton, benoit_, rouslan, dlehn, nelsoncwwu,
07:50:35 <Zakim> ... TimCappalli, imlostlmao, npd, Github, hober, Dongwoo, smcgruer_[EST], nicktr, wanderview, hadleybeeman, ljharb, tobie, rbyers, slightlyoff, Ian, weiler
07:51:01 <Tabitha> Tabitha has joined #wpwg
07:51:21 <nicktr> present+ evan_jacobs
07:51:44 <nicktr> topic: Stripe SPC update
07:52:18 <nicktr> evan_jacobs: Regulation is driving friction in payments
07:52:30 <nicktr> ...particularly in 3DS
07:52:48 <nicktr> ...we have been looking at biometric authentication
07:53:11 <nicktr> ...we look to see if we have seen a device before
07:53:17 <Gerhard_> q?
07:53:28 <nicktr> ...if new, we enrol via 3DS
07:53:59 <nicktr> ack sm`
07:54:02 <nicktr> ack smcgruer_[EST]
07:54:03 <Zakim> smcgruer_[EST], you wanted to offer to scribe when I'm not talking
07:54:09 <Dingwei_> present+
07:54:14 <aidanfoley> Stephen is the expert here :-)
07:54:30 <nicktr> evan_jacobs: shows flow
07:54:43 <bryanluo> present+ bryanluo
07:55:06 <nicktr> ...shows SPC "opt in"
07:55:19 <Gerhard_> q+
07:55:22 <nicktr> q+
07:55:31 <gkok> present+
07:55:56 <nicktr> Gerhard_: I see you are using "biometrics" not "passkey"
07:56:07 <bkardell_> bkardell_ has joined #wpwg
07:56:07 <nicktr> ...does that cause issues when biometrics are not available
07:57:04 <nicktr> aidanfoley: we will be revisiting all of the UX but we went with biometrics as the cue that would provoke users the most
07:57:15 <nicktr> ack Gerhard_
07:57:20 <nicktr> q-
07:57:56 <nicktr> evan_jacobs: shows returning user case
07:58:53 <nicktr> ...throughout the the user flow, opt out is available
07:59:16 <nicktr> ...turning to results. We are seeing a 7% improvement in authentication success
07:59:43 <nicktr> ...when returning users choose biometrics, success rates is >95%
07:59:59 <gkok> q+
08:00:07 <nicktr> ...but only 50% of returning choose biometrics
08:00:37 <nicktr> ...and latency is hugely improved from 30s to 12s
08:01:04 <nicktr> gkok: do you know whether the returning users are on the same device?
08:01:13 <SameerT> q+
08:01:50 <nick_s> q+
08:01:50 <nicktr> evan_jacobs: we are looking at improving the that
08:02:16 <nicktr> gkok: is the authentication improvement matched in authorisation rate
08:02:22 <nicktr> evan_jacobs: no
08:02:24 <gkok> q-
08:02:58 <nicktr> aidanfoley: we have pilot running with an issuer currently, where authorisation rate is better
08:03:10 <nicktr> SameerT: this looks like delegated authentication
08:04:29 <nicktr> do you have any analysis of comparisons between this authentication mode v authentication offered by the issuer?
08:05:52 <fahad> q+
08:06:12 <tomasz> q+
08:07:04 <nicktr> sameer: what happens if the enrolment fails? Does the merchant lose the transaction?
08:07:26 <nicktr> aidanfoley: the enrolment happens _after_ a successful transaction
08:07:40 <nicktr> ack SameerT
08:07:49 <Gerhard_> q+
08:07:52 <nicktr> ack nick_s
08:08:10 <nakjo_shishkov> nakjo_shishkov has joined #wpwg
08:08:11 <nicktr> nick_s: is enrolment per psp?
08:08:22 <nicktr> ...i.e. it's only for Stripe
08:08:25 <nicktr> aidanfoley: yes
08:08:56 <Melissa_VS> Melissa_VS has joined #wpwg
08:10:02 <tomasz> q-
08:10:07 <nicktr> nick_s: I'm worried about this as a barrier for new PSPs
08:10:17 <nicktr> q+
08:10:34 <nicktr> ...it would be nice to see this shared across PSPs
08:10:36 <smcgruer_[EST]> q?
08:11:13 <sami> sami has joined #wpwg
08:11:59 <nicktr> fahad: could you get better times  via the issuer?
08:12:16 <tomasz> q+
08:12:25 <nicktr> aidanfoley: we continue to look at this
08:12:28 <nicktr> q?
08:12:35 <nicktr> ack fahad
08:12:40 <nicktr> ack Gerhard_
08:12:55 <nicktr> Gerhard_: who has liability? are you sending the binding?
08:13:16 <nicktr> aidanfoley: Stripe are currently taking the liability with the delegated authentication flag set
08:13:52 <nicktr> ...and we continue to learn from it
08:14:30 <nicktr> evan_jacobs: we are getting less fraud with this than "vanilla" 3DS but we are cautious about that
08:14:37 <nicktr> aidanfoley: we are only 90 days in
08:15:17 <nicktr> evan_jacobs: we are also seeing higher success with webauth rather than SPC which we don't understand
08:15:41 <nicktr> tomasz: did you try to run this as SPC directly
08:16:36 <smcgruer_[EST]> q?
08:16:36 <nicktr> aidanfoley: we do have this. The drop off is happening on the "OS prompt".
08:17:17 <nicktr> tomasz: are you running this across platforms
08:17:32 <smcgruer_[EST]> q+
08:17:34 <nicktr> aidanfoley: yes, but when we launched on android then the drop off was big
08:17:41 <nicktr> tomasz: do you know why?
08:18:06 <nicktr> aidanfoley: no.
08:18:43 <nicktr> evan_jacobs: to conclude - we continue to experiment, with much more UX research, and how to get more issuers involved
08:18:47 <nicktr> q?
08:18:51 <nicktr> ack tomasz
08:18:51 <smcgruer_[EST]> q-
08:22:02 <Gerhard_> q+
08:22:17 <TEngland> TEngland has joined #wpwg
08:22:36 <nicktr> Zakim: nicktr: thanks aidanfoley, evan_jacobs
08:22:56 <nicktr> nicktr: I think new PSPs have plenty of challenges!
08:23:50 <Gerhard_> q?
08:24:16 <nicktr> nick_s: yes, but we should not put in  improvements that clearly favour larger PSPs
08:24:21 <nicktr> topic: Visa update
08:24:57 <Gerhard_> q-
08:25:02 <nicktr> ack nick_s
08:25:06 <nicktr> ack nicktr
08:25:22 <nicktr> doug_F: presents slides
08:26:02 <nicktr> ...Visa has been focussing on the use case of merchant initiated SPC where the issuer is the relying party
08:26:13 <nicktr> ...we have been conducting to pilots
08:26:22 <nicktr> ...both have 3ds architectures
08:26:49 <nicktr> ...phase 1 - friends and family
08:27:00 <nicktr> ...phase 2 - limited BIN range
08:27:42 <nicktr> ...the pilot is using 3DS 2.3.1.1 (the very latest specification)
08:28:40 <nicktr> <shows flow with AReq and ARes>
08:29:12 <nicktr> ...the SPC assertion is passed in via a second AReq
08:29:38 <nicktr> ...the second pilot is using 2.2 with an extension with Modirum
08:30:29 <nicktr> ...both bringing reassurance about backward compatibility and a check in the latest spec
08:31:26 <nicktr> doug_F: we wanted to provide feedback on UI and to investigate SPC v other authentication
08:31:57 <nicktr> ...we also wanted to to look at fallback to 3DS if the user hits cancel or other failure states
08:33:23 <nicktr> ... we found that users need more context and explanation of the value proposition
08:33:45 <nicktr> ...many participants struggled to understand what they were being asked to do and why
08:34:11 <nicktr> ...and in particular didn't understand that the credentials were specific to the browser
08:35:16 <nicktr> doug_F: we found that the passkey dialogue box caused confusion (we saw one user trying to write things down)
08:37:17 <nicktr> ...we found that users tried to "touch" the fingerprint image on the SPC dialogue
08:37:34 <nicktr> ...there was a lot of difference between OS
08:38:06 <nicktr> ...with better results in MacOS than in Windows
08:39:12 <nicktr> q+ to talk about windows hello experience
08:39:42 <nicktr> ...windows dialogues seemed to cause more problems
08:39:50 <smcgruer_[EST]> q+ to ask about user.name/user.displayName as what looks like an id
08:40:47 <nicktr> doug_F: cancel did not test well
08:41:05 <nicktr> ...but sentiment towards biometrics was generally positive
08:41:28 <Gerhard_> q+
08:41:31 <nicktr> ...3DS tested well - but European users in particular are very familiar
08:42:20 <nicktr> ...inconsistency across OS and devices and browsers is a real challenge
08:42:20 <nicktr> ...VIS recommesa iterative content and interaction design work
08:42:51 <nicktr> doug_F: comapres SPC v OTP
08:43:15 <nicktr> s/comapres/compares/
08:43:24 <nicktr> ...SPC is faster!
08:44:47 <nicktr> doug_F: shows demo and points out additional browser screen to prevent timing attack but which adds friction
08:44:52 <nicktr> q?
08:45:16 <nicktr> ack smcgruer_[EST]
08:45:16 <Zakim> smcgruer_[EST], you wanted to ask about user.name/user.displayName as what looks like an id
08:45:34 <tomasz> q+
08:46:16 <nicktr> smcgruer_[EST]: if might be easier to add card name in the display name fields
08:46:48 <nicktr> doug_F: behaviour is different between browsers
08:47:27 <Soumya> Soumya has joined #wpwg
08:47:46 <nicktr> smcgruer_[EST]: on the no matching credentials dialogue, is this a different device issue?
08:47:50 <nicktr> doug_F: yes
08:48:32 <nicktr> Gerhard_: chrome and safari uses different data fields in webauthn
08:49:19 <nicktr> Gerhard_: 3DS tests better but users are more familiar - do you think it's this familiarity is driving the better result?
08:49:46 <nicktr> doug_F: I think it's both familiarity and maturity - we have done so much testing of 3DS
08:49:48 <tomasz> q?
08:49:54 <nicktr> ack Gerhard_
08:50:19 <rbyers> q+
08:50:20 <smcgruer_[EST]> q+ to also ask about merchant-triggered vs acs-triggered
08:50:48 <nicktr> q+ later
08:50:52 <nicktr> q-
08:51:24 <nicktr> ack tomasz
08:51:43 <Dingwei> Dingwei has joined #wpwg
08:52:02 <nicktr> tomasz: points out window hello uses the receiving party ID
08:52:32 <gkok> q+
08:52:34 <nicktr> smcgruer_[EST]: webauthn community pushed back on using receiving party name
08:52:44 <nicktr> ...but might now be different
08:52:53 <nicktr> ...it's very confusing for the user
08:53:13 <nicktr> ...most users don't know who the PSP is (even Stripe)
08:53:44 <SameerT> q+ for Imran/Nakjo - how will the fallback work on merchant initiated flow when the intermittent user activation screen is removed
08:53:48 <nicktr> aidanfoley: users just know where they are shopping - the merchant name
08:54:07 <nicktr> q-
08:54:15 <nicktr> ack rbyers
08:54:19 <smcgruer_[EST]> s/receiving/relying
08:54:33 <nicktr> rbyers: did you test webauthn v SPC like Stripe?
08:55:41 <nicktr> doug_F: we looked at webauthn as a fallback
08:55:46 <nicktr> q?
08:55:48 <smcgruer_[EST]> q-
08:56:15 <nicktr> q?
08:57:04 <tomasz> q?
08:57:59 <tomasz> q+
08:58:13 <nicktr> gkok: suggests improvement to flow (didn't catch detail)
08:58:35 <nicktr> dougF: we didn't try that
08:59:19 <gkok> suggests improvement to flow by replacing the "cancel" button by something like "verify through other means"
08:59:21 <nicktr> ack SameerT
08:59:21 <Zakim> SameerT, you wanted to discuss Imran/Nakjo - how will the fallback work on merchant initiated flow when the intermittent user activation screen is removed
08:59:34 <nicktr> ack gkok
09:00:34 <nicktr> tomasz: have you compared SPC v mobile authentication for 3DS
09:00:50 <nicktr> dougF: yes, and we could demo that
09:01:55 <nicktr> imran_ahmed presents modirum findings from SPC
09:02:56 <nicktr> <summary slide>
09:04:04 <nicktr> imran: transient user activation is required  - we have implemented a dual authentication option but this is removed in  Chrome v118
09:04:37 <nicktr> imran: flow when a new device is present is two additional clicks
09:05:07 <nicktr> imran: user ID is tied to "name" field, tied to user not device
09:05:24 <nicktr> ...windows shows on registration and authentication
09:05:37 <nicktr> ...but Android and MacOS shows only on registration
09:05:59 <nicktr> ...possibly alternatives: PAN, masked PAN, or user chosen name
09:07:34 <nicktr> ...SPC credential is unique ID - user ID + RP ID _ device platform authenticator
09:08:02 <nicktr> ...case 1: browsers not sharing SPC credentials (except Android)
09:08:20 <nicktr> ...case 2: Windows11 passkey synching
09:08:38 <nicktr> ...but SPC credentials are not shared
09:08:57 <Gerhard_> q+
09:09:06 <nicktr> ...registration on new device fails - platform authenticator reports credentials already exists
09:09:14 <nicktr> ack tomasz
09:10:02 <nicktr> imran: future considerations - biometrics clearly very important in SPC
09:10:09 <Peter> Peter has joined #wpwg
09:10:41 <nicktr> ...would be good to see issuer and scheme lgogs on SPC UI
09:10:48 <Bastien> Bastien has joined #WPWG
09:10:52 <Adam_> Adam_ has joined #wpwg
09:12:04 <nicktr> ...would like to understand effect on public key extensions and also role of roaming authenticators
09:12:49 <nicktr> Gerhard_: points out difference between "trust this device" or "trust this browser"
09:13:33 <nicktr> smcgruer_[EST]: webauthn is "trust this platform"
09:16:02 <rbyers> FedID CG meeting next: https://github.com/fedidcg/meetings/blob/main/2023/2023-09-11-TPAC-agenda.md
09:16:07 <Evan_Jacobs> Evan_Jacobs has joined #wpwg
09:16:09 <rwatkins-ma> rwatkins-ma has joined #wpwg
09:16:42 <Kavya> Kavya has joined #wpwg
09:16:48 <nicktr> break for coffee
09:17:37 <JAYADEVI> JAYADEVI has joined #wpwg
09:17:47 <rbyers> zoom link: https://w3c.zoom.us/j/9020046588?pwd=TlFQODcrdEZhajBjODI0bm91N2pYQT09
09:30:50 <nick_s> nick_s has joined #wpwg
09:36:42 <benoit_> benoit_ has joined #wpwg
10:21:51 <helen> helen has joined #wpwg
10:27:32 <benoit_> benoit_ has joined #wpwg
10:36:11 <Melissa_VS> Melissa_VS has joined #wpwg
10:37:34 <nick_s> nick_s has joined #wpwg
10:38:09 <Adam_> Adam_ has joined #wpwg
10:38:32 <nicktr> topic: Update on SPC with passkeys
10:38:45 <RRSAgent> I have made the request to generate https://www.w3.org/2023/09/11-wpwg-minutes.html nicktr
10:39:09 <benoit_> benoit_ has joined #wpwg
10:39:13 <Bastien> Bastien has joined #WPWG
10:39:18 <SameerT_> SameerT_ has joined #wpwg
10:42:06 <Dingwei> Dingwei has joined #wpwg
10:43:20 <nicktr> q?
10:43:31 <nicktr> queue=
10:45:48 <fahad> fahad has joined #wpwg
10:48:05 <nick_s> present+
10:48:10 <fahad> present+
10:48:11 <Melissa_VS> present+
10:48:13 <JeanLuc> present+
10:48:13 <rwatkins-ma> present+
10:48:15 <westin> present+
10:48:16 <TEngland> TEngland has joined #wpwg
10:48:16 <Gerhard> Gerhard has joined #wpwg
10:48:16 <kenneth> present+
10:48:18 <SameerT_> present+
10:48:18 <Adam_> present+
10:48:18 <Gerhard> present+
10:48:21 <benoit> present+
10:48:32 <HelenQin> HelenQin has joined #wpwg
10:48:33 <Tabitha> Tabitha has joined #wpwg
10:48:36 <Soumya> Soumya has joined #wpwg
10:48:36 <HelenQin> present+
10:48:37 <Peter_> Peter_ has joined #wpwg
10:48:42 <Nakjo_Shishkov> Nakjo_Shishkov has joined #wpwg
10:48:42 <Dingwei> present+
10:48:43 <Evan_Jacobs> Evan_Jacobs has joined #wpwg
10:48:43 <Tabitha> present+
10:48:44 <hari> present+
10:48:51 <Nakjo_Shishkov> present+
10:48:52 <Peter_> present+
10:48:52 <TEngland> present+
10:48:53 <Soumya> present+
10:48:54 <Evan_Jacobs> present+
10:48:57 <sioked> present+
10:49:21 <tomasz> tomasz has joined #wpwg
10:49:24 <tomasz> present+
10:49:26 <Bastien_> Bastien_ has joined #WPWG
10:49:28 <Bastien_> present+
10:51:14 <Imran> Imran has joined #wpwg
10:51:15 <nicktr> jonathan presents objectives slides:
10:51:22 <nicktr> 1) reduce fraud and false declines
10:51:27 <Imran> present
10:51:27 <nicktr> 2) reduce friction
10:51:37 <nicktr> 3) improve conversion
10:52:49 <nicktr> jonathan: identfies use cases for passkey and cards
10:53:00 <nicktr> ...issuer is the relying party
10:53:14 <nicktr> ...merchant/PSP/wallet is the relying party
10:54:30 <nicktr> ...(authentication ultimately passed to issuer via scheme specific mechanism
10:54:34 <gkok> gkok has joined #Wpwg
10:54:55 <nicktr> ...lastly, where mastercard is the relying party
10:55:10 <gkok> gkok has left #wpwg
10:55:21 <gkok> gkok has joined #wpwg
10:55:34 <gkok> gkok has left #wpwg
10:55:47 <gkok> gkok has joined #wpwg
10:55:52 <nicktr> ...which has advantages in terms of consumer familiarity with the mastercard brand
10:56:14 <nicktr> jonathan: what does SPC bring over webauthn?
10:56:41 <nicktr> ...1) only prompt when there is an authentication credential on the device
10:57:00 <nicktr> 2) x-origin authentication
10:57:08 <nicktr> 2) dynamic linking
10:57:16 <JMGirard> JMGirard has joined #wpwg
10:57:22 <nicktr> s/2) dynamic/3) dynamic/
10:57:33 <nicktr> 4) consistency and secure display
10:58:20 <nicktr> jonathan: secure display includes "sign what you see"
10:59:23 <nicktr> smcgruer_[EST]: with SPC there are additional fields in the challenge result (you could do it with webauthn but it's explicit in SPC)
10:59:31 <nick_s> q+
10:59:50 <nicktr> ack nick_s
11:00:45 <nicktr> nick_s: we need to stop SPC allowing discovery of whether biometry is enabled
11:00:57 <nicktr> smcgruer_[EST]: agreed - we need to improve the UX
11:01:31 <nicktr> jonathan: if there is no credential, is there no dialogue?
11:01:51 <nicktr> smcgruer_[EST]: no, there is always a dialogue, but the fallback UI is not good
11:02:41 <gkok> Q+
11:03:10 <nicktr> ...FedCM is trying to do this with a complicated timing screen which does not have consensus across the browser vendors
11:06:02 <Sami> Sami has joined #wpwg
11:06:21 <nicktr> gkok: could issuers learn what kind of verification has occurred
11:06:46 <nicktr> smcgruer_[EST]: not at the moment - it would definitely be a topic for discussion with webauthn wg tomorrow
11:07:40 <nicktr> rakesh: what kind of support are we seeing from issuers?
11:08:07 <nicktr> SameerT_: login is an easy use case for issuers as it's a first party context
11:08:28 <nicktr> SameerT_: but enrolment is more difficult and payment another step beyond that
11:09:19 <nicktr> gerard: iframes lack permissions, fallback in web versus apps
11:09:36 <nicktr> ...and the lack of consistency causes friction
11:09:57 <nicktr> s/gerard: iframes/Gerhard : iframes/
11:10:35 <nicktr> jonathan: shows example flow with passkey
11:10:46 <nicktr> present+: jonathan_grossar
11:11:22 <nicktr> ...(registration during checkout)
11:12:26 <nicktr> ...(returning user)
11:12:49 <nicktr> ...showing difference between vanilla webauthn and SPC
11:13:23 <nicktr> jonathan: introduction of passkeys brings two new challenges
11:14:06 <nicktr> ...1) passkeys don't have an attestation to allow validation
11:15:09 <nicktr> ...2) passkeys are synchronised across devices. some implementations don't allow the RP to work out which device the user is on
11:15:45 <nicktr> q+ to ask about attestation
11:15:50 <nicktr> ack gkok
11:16:43 <nick_s> q+
11:17:16 <Gkok> Gkok has joined #Wpwg
11:17:19 <Peter> Peter has joined #wpwg
11:17:26 <Gkok> +q
11:18:34 <nicktr> ack nicktr
11:18:34 <Zakim> nicktr, you wanted to ask about attestation
11:18:58 <nicktr> nicktr: did we lose attestation when passkey was introduced?
11:19:26 <nicktr> jonathan: no, it's only option in webauthn
11:19:53 <nicktr> nick_s: can you say more about why it's difficult for SCA
11:21:09 <nicktr> jonathan: the lack of information about how the user possession is validated
11:21:58 <nicktr> ack Gkok
11:22:01 <nicktr> ack nick_s
11:23:44 <nicktr> gkok: understanding where the liability sits is critical
11:24:09 <nicktr> q?
11:24:52 <nicktr> q+ to observe that the schemes have made the liability situations clear in the past (for example with the introduction of 3DS)
11:25:13 <nicktr> ack nicktr
11:25:13 <Zakim> nicktr, you wanted to observe that the schemes have made the liability situations clear in the past (for example with the introduction of 3DS)
11:27:12 <Sami> Sami has joined #wpwg
11:27:36 <nicktr> nicktr: the ecosystem works best when everyone understands where the risk is sitting so ideally we would "paint" the transaction with all the information that would be necessary
11:27:54 <smcgruer_[EST]> q?
11:28:01 <nicktr> jonathan: (shows degraded UX)
11:28:11 <smcgruer_[EST]> q+
11:28:20 <nick_s> q+
11:28:50 <nicktr> smcgruer_[EST]: it sounds like in a 1P context, webauthn works
11:29:09 <nicktr> ...in a 3P context, would an iframe suffice?
11:29:43 <nicktr> ...in other words, should we just make webauthn work better in iframes?
11:30:03 <nicktr> jonathan: we would prefer not to have to open iframes
11:31:15 <nicktr> jonathan: (shows potential use case of using SPC to access their account e.g. click to pay)
11:31:25 <nicktr> ack smcgruer_[EST]
11:32:01 <nicktr> ...which would require changes to prompt and also removal of "total" field
11:32:13 <nicktr> ack nick_s
11:32:30 <nicktr> nick_s: don't cookies have the same problem? Cookies can be back up
11:32:42 <nicktr> s/back up/backed up/
11:33:56 <nicktr> nick_s: it sounds like what we really want is a way of uniquely identifying that the device that was enrolled is the one presenting the credential
11:35:28 <nicktr> smcgruer_[EST]: is cookie theft in your threat model, payment folks?
11:36:00 <nicktr> rakesh: it certainly informs our thinking
11:36:32 <nicktr> nick_s: sounds like there is other data that we could use
11:38:37 <RRSAgent> I have made the request to generate https://www.w3.org/2023/09/11-wpwg-minutes.html nicktr
11:39:01 <nicktr> Gerhard: may I remind you that there is a world outside Europe and we need to find that balance
11:39:15 <nicktr> break for lunch
11:45:26 <benoit_> benoit_ has joined #wpwg
11:46:23 <benoit_> benoit_ has joined #wpwg
12:14:17 <bryanluo> bryanluo has joined #wpwg
12:27:32 <Adam_> Adam_ has joined #wpwg
12:27:55 <bryanluo> bryanluo has joined #wpwg
12:29:47 <bryanluo_> bryanluo_ has joined #wpwg
12:33:26 <benoit_> benoit_ has joined #wpwg
12:33:42 <nick_s> nick_s has joined #wpwg
12:33:54 <westin> westin has joined #wpwg
12:34:10 <SameerT> SameerT has joined #wpwg
12:35:47 <bryanluo> bryanluo has joined #wpwg
12:36:50 <Gkok> Gkok has joined #wpwg
12:38:10 <rouslan> present+ Rouslan
12:38:10 <fahad> fahad has joined #wpwg
12:38:10 <nicktr> topic: netcetera demos
12:39:15 <bryanluo_> bryanluo_ has joined #wpwg
12:39:15 <nicktr> present+ nakjo_shishkov
12:39:15 <nicktr> zakim, who is here?
12:39:15 <Zakim> Present: Arman, benoit, canton, Stephen_McGruer, Helen_Qin, Rick_Byers, evan_jacobs, Dingwei_, bryanluo, gkok, nick_s, fahad, Melissa_VS, JeanLuc, rwatkins-ma, westin, kenneth,
12:39:15 <Zakim> ... SameerT_, Adam_, Gerhard, HelenQin, Dingwei, Tabitha, hari, Nakjo_Shishkov, Peter_, TEngland, Soumya, sioked, tomasz, Bastien_, :, jonathan_grossar, Rouslan
12:39:15 <Zakim> On IRC I see bryanluo_, fahad, Gkok, bryanluo, SameerT, westin, nick_s, benoit_, Adam_, JMGirard, SameerT_, Melissa_VS, helen, Kavya, bkardell_, bfeigel, benoit, kenneth, JeanLuc,
12:39:15 <Zakim> ... RRSAgent, Zakim, hari, tminamii, pea1358, canton, rouslan, dlehn, nelsoncwwu, TimCappalli, imlostlmao, npd, Github, hober, Dongwoo, smcgruer_[EST], nicktr, wanderview,
12:39:15 <Zakim> ... hadleybeeman, ljharb, tobie, rbyers, slightlyoff, Ian, weiler
12:39:15 <Gerhard> Gerhard has joined #wpwg
12:39:15 <martin_a> martin_a has joined #wpwg
12:39:48 <martin_a> present+ martin_alvarez
12:39:48 <nicktr> nakjo: our demo ran on v2.3.1.1, with a participating issuer and and participating merchant
12:39:48 <evan_jacobs> evan_jacobs has joined #wpwg
12:40:52 <bryanluo_> bryanluo_ has joined #wpwg
12:40:52 <Tony_E> Tony_E has joined #wpwg
12:41:01 <sioked> sioked has joined #wpwg
12:41:04 <nicktr> (shows demo store in a preview environment)
12:41:43 <RRSAgent> I have made the request to generate https://www.w3.org/2023/09/11-wpwg-minutes.html nicktr
12:41:44 <tomasz> tomasz has joined #wpwg
12:43:28 <nicktr> (shows non-happy path, the requestor doesn't support SPC)
12:43:31 <Jayadevi> Jayadevi has joined #wpwg
12:44:11 <Soumya> Soumya has joined #wpwg
12:44:11 <bryanluo> bryanluo has joined #wpwg
12:44:11 <SameerT> q+
12:44:30 <fahad> q+
12:45:02 <rwatkins-ma> rwatkins-ma has joined #wpwg
12:45:16 <nicktr> SameerT: in merchant initiated flow, there's no iframe - there's no issuer messaging
12:45:20 <Sami> Sami has joined #wpwg
12:45:41 <nicktr> ...but in the second flow, the issuer has rendered an iframe. Just wanted to highlight that
12:45:50 <nicktr> ack SameerT
12:45:51 <Gkok> Gkok has joined #Wpwg
12:45:52 <Gkok> Q+
12:47:24 <martin_a> martin_a has left #wpwg
12:47:24 <Bastien> Bastien has joined #WPWG
12:47:27 <nicktr> fahad: who makes the "show credential" the call?
12:48:16 <nicktr> nakjo: in the merchant initiated page, it's the merchant. In the non-spc flow, it's the issuer)
12:48:20 <nicktr> Gkok:
12:48:50 <nicktr> ack Gkok
12:48:53 <nicktr> ack fahad
12:49:26 <nicktr> nakjo: (shows the fail flow - hits cancel)
12:49:56 <nicktr> (defaults to out of band authentication)
12:53:01 <Tabitha> Tabitha has joined #wpwg
12:53:22 <Tabitha> present+
12:56:03 <Sami> present+
12:56:03 <Gkok> Q+
12:56:25 <smcgruer_[EST]> q+
12:57:02 <Gkok> Q-
12:57:06 <Gerhard> q+
12:57:07 <rouslan> q+ to ask about `"showOptOut": true` on the code snippet slide. Is there a use case for it? Is that useful?
12:57:29 <nicktr> nakjo: shows mismatch between 3DS and SPC spec (3DS spec has Relying party ID, credential pairs, SPC has one RP ID and multiple credentials)
12:57:42 <nicktr> ...(shows unregister UI)
12:57:51 <Gkok> Q+
12:58:32 <nicktr> ...I don't know whether there is a maximum number of credentials
12:59:14 <nicktr> smcgruer_[EST]: I think the 3DS/SPC mismatch fix is relatively fixable
13:00:10 <rouslan> q-
13:00:48 <nicktr> ...with regard to the opt out, the intent of the Chrome implementation, we suggest that the opt out link takes the user to somewhere where they can manage the credentials that the caller has issued
13:01:25 <nicktr> dougF: in the third-party model, the issuer needs to be able to invoke this
13:01:44 <nicktr> smcgruer_[EST]: I think we assumed the issuer and merchant would have to talk.
13:02:05 <alakatos> alakatos has joined #wpwg
13:02:27 <nicktr> ...the link is not a "weblink" - it causes the authentication to fail with an error conditions
13:02:44 <nicktr> ..."opt out error"
13:03:00 <nicktr> q?
13:03:07 <nicktr> ack smcgruer_[EST]
13:04:11 <nicktr> smcgruer_[EST]: is this opt out still important?
13:04:11 <nicktr> nakjo: yes, deregistration is still important
13:04:54 <nicktr> ack Gerhard
13:05:03 <imran> imran has joined #wpwg
13:05:22 <nicktr> Gerhard: would it be possible for a directory server to add its RPID ?
13:06:22 <nicktr> nakjo: yes, technically you could do this, but I don't know what would happen on the ACS?
13:08:12 <nicktr> gerhard: what happens with multiple credentials?
13:08:27 <nicktr> smcgruer_[EST]: we would only show credentials that could be used?
13:08:45 <nicktr> q?
13:10:57 <nicktr> Gkok: it's not clear how we would prioritise which one to use if there were more than one
13:12:04 <nicktr> ...and I'd suggest that the opt out resulted in a signed request to remove the credential
13:13:10 <nicktr> nakjo: (demos flow when SPC is not supported by requestor or in iframe)
13:13:44 <nicktr> nakjo: here we fall back to webauthn in a new window with access in a 1P context
13:14:15 <rouslan> q+ to talk about popups with WebAuthn and SPC
13:14:41 <nicktr> ack Gkok
13:15:04 <nicktr> nakjo: the sandbox attribute means that this doesn't work
13:15:18 <nicktr> ack rouslan
13:15:18 <Zakim> rouslan, you wanted to talk about popups with WebAuthn and SPC
13:15:35 <Gkok> Q+
13:16:17 <wanderview> wanderview has left #wpwg
13:16:30 <rouslan> q?
13:16:45 <SameerT> q+
13:16:54 <nicktr> nakjo: we're talking about a back up of a back up here
13:17:01 <nicktr> ack Gkok
13:18:39 <nicktr> gkok: could we just default SPC on in iframes?
13:18:42 <nicktr> smcgruer_[EST]: no
13:18:52 <SameerT> q-
13:19:10 <nicktr> dougF: but SPC is now in the requirements of 3DS including the browser settings
13:19:15 <nicktr> q?
13:20:02 <nicktr> nakjo: many corporate managed computers and phones restrict platform authenticators including windows hello
13:20:27 <nicktr> ...and platform authenticator is not available in private/incognito mode
13:21:16 <nicktr> topic: netcetera demo of SPC on Android with custom tabs
13:21:56 <tomasz> q?
13:22:05 <nicktr> (shows passkey registration and authentication flows)
13:23:16 <nicktr> nakjo: purpose of this investigation was to see if we could do SPC from a native app - or at least as close to native as possible
13:24:18 <nicktr> ...we had a native application that contained the checkout experience and moved the SPC challenge "next to" the native app via a web landing page
13:24:29 <SameerT> q+
13:25:07 <SameerT> q-
13:25:22 <nicktr> ...we had several failed attempts - webview failed so we tried custom tabs
13:25:45 <nicktr> (shows demo app)
13:26:49 <nick_s> q+
13:29:13 <nicktr> q?
13:29:49 <tomasz> q+
13:29:55 <SameerT> q+
13:29:56 <nicktr> nakjo: shows it's possible to deliver SPC experience in a custom tabs
13:30:26 <nicktr> nick_s: what's the benefit of relying on SPC v the bank's app
13:30:42 <nicktr> ack nick_s
13:31:05 <nicktr> Gerhard: not all banks have a native app
13:31:20 <Gkok__> Gkok__ has joined #Wpwg
13:31:22 <nicktr> ...and consumers get lost moving between apps
13:31:31 <nicktr> ...3DS 2.3.1 addresses some of that
13:31:38 <nicktr> ack tomasz
13:32:38 <nicktr> can you explain the communication between the custom tab and the native app?
13:33:14 <Gkok___> Gkok___ has joined #Wpwg
13:33:31 <Gkok___> Q+
13:33:36 <nicktr> nakjo: we use a specific redirect URL and a link listener in the native app (which then checks the status)
13:33:38 <nicktr> q?
13:34:11 <nicktr> ac SameerT
13:34:11 <nicktr> ack SameerT
13:34:12 <nicktr> SameerT: is this over 3DS?
13:34:21 <nicktr> nakjo: no, though it could be.
13:34:52 <nicktr> q?
13:36:15 <nicktr> ack Gkok___
13:36:17 <smcgruer_[EST]> q+
13:36:23 <smcgruer_[EST]> q-
13:37:14 <fahad> q+
13:37:18 <nicktr> nakjo: we can use custom tabs, but session handling, landing authentication page is tricky
13:37:38 <nicktr> ...error handling is also harder
13:37:50 <nicktr> ...and redirection to native app doesn't always work
13:38:16 <nicktr> ...also you may have to override the default browser
13:38:38 <fahad> q-
13:38:46 <nicktr> ...ideas for improvement include message exchange or event listener
13:38:50 <nicktr> q?
13:39:31 <nicktr> Gkok___: I would love to see this working better if SPC in general picks up in popularity
13:39:58 <nicktr> ...is there a world where native apps could use SPC more easily?
13:40:33 <nicktr> smcgruer_[EST]: yes. We would love to make the workarounds unnecessary but we need to get the priority to do this work
13:41:09 <nicktr> Gerhard: it would be great to get "do SPC" added to the 3DS spec in the merchant app API
13:42:35 <nicktr> SameerT: I could possibly see this working for bigger merchant apps, where they may already be doing biometric authentication
13:43:13 <nicktr> Gerhard: doing this for each merchant app is a deployment nightmare
13:43:16 <nicktr> q?
13:43:59 <nicktr> topic: apple perspectives
13:44:16 <nicktr> nick_s: we are happy to be back
13:46:30 <nicktr> nick_s: we support payment request in MacOS, iOS, iPad and VisionPro (sp?) with authentication via iris
13:46:30 <nicktr> ...on SPC - we are potentially interested as a merchant and also in delegated authentication
13:47:11 <nicktr> ...it would be interesting to see SPC on other payment methods
13:48:04 <nicktr> nick_s: (for clarity, I work on ApplePay not webkit)
13:48:11 <nicktr> nick_s: we would love to see shipping and billing address back in payment request
13:48:14 <nicktr> ...we know there are challenges with I18n and privacy
13:50:20 <nicktr> nick_s: we are now supporting "advance fraud protection" for Visa cards which is a private connection between the device and ?scheme? (NickTR missed this endpoint)
13:50:40 <nicktr> ...we are interested in the receipt use case
13:50:42 <nicktr> q?
13:51:56 <nicktr> Gerhard: could that additional information be provided to the issuer?
13:51:56 <nicktr> q?
13:52:22 <nicktr> nick_s: I think we would be interested in investigating that as a standardised way of communicating it
13:52:47 <nicktr> gkok: what are the roadblocks for SPC?
13:53:18 <nicktr> ...I think there are clearly user experience and privacy issues to resolve
13:53:37 <rbyers> https://github.com/WebKit/standards-positions/issues/30
13:53:55 <nicktr> ...you can see Apple's positions here -> https://github.com/WebKit/standards-positions/issues/30positions on standards
13:54:17 <nicktr> q?
13:55:54 <nicktr> nick_s: if there is interest in using SPC in native apps, I think it would be interesting to explore how we could make this more seamless
13:56:52 <nicktr> joyce: could I have better control over my physical payments like I have on web payments? For example, the payment confirmation
13:57:25 <nicktr> nick_s: I would be delighted to talk to you about that - one limitation is the information that's available via the NFC interface
13:59:11 <nicktr> ...some of these payment standards are quite old
14:00:33 <nicktr> ...we have also recently introduced taking payments contactlessly via iphones and have made some accessibility improvements there
14:00:36 <nicktr> q?
14:01:30 <rbyers> FWIW Rick and Stephen had to jump for a meeting 4:00-4:30, but we're obviously very interested in this topic. Sorry for the conflict.
14:02:01 <Gkok> Gkok has joined #wpwg
14:02:15 <Gkok> Q+
14:02:52 <Adam_> Adam_ has joined #wpwg
14:03:41 <nicktr> Sami: are we trying to define best practices for SPC implementations?
14:04:41 <nicktr> Gerhard: I think it would be great if we could come up with a framework for comparing SPC implementations
14:05:27 <nicktr> evan_jacobs: we have a lot of challenge talking to issuers because we often measure different metrics or see different results
14:06:30 <nicktr> sami: we see lots of different approaches
14:07:23 <nicktr> Gkok: I can see both issuer and scheme implementations working depending on scale of the issuer
14:07:38 <nicktr> ack Gkok
14:07:55 <nicktr> gkok: let me give a merchant perspective
14:08:22 <nicktr> ...we really need relying parties outside our PSPs
14:08:38 <nicktr> ...and in particular more issuers
14:09:11 <nicktr> ...there is interest from issuers but they're not getting consistent messaging and support  and information
14:09:55 <nicktr> ...mobile browser is giving us the biggest headache for conversion
14:10:06 <imran> imran has joined #wpwg
14:10:11 <nicktr> ...and diagnosis is really hard
14:10:57 <nicktr> ...again, as a merchant, we need more "insurance".
14:11:16 <alakatos> alakatos has joined #wpwg
14:12:04 <nicktr> gkok: it's all about the value of the user - particular on the first transaction. I would give up liability shift on first transaction
14:12:27 <nicktr> evan_jacobs: is there interest in implementing SPC in non-SCA markets?
14:13:11 <nicktr> gkok: yes, if the performance uptick is worthwhile. It all comes down to the experience
14:13:11 <nick_s> q+
14:13:31 <nicktr> evan_jacobs: I do wonder if there is an opportunity to do more with delegate authentication in the US market
14:14:08 <nicktr> nick_s: the optimist thinks that would be great. the pessimist (realist) looks at how hard Chip and PIN was in the US
14:14:36 <nicktr> ...I think you either need either regulation or a significant economic incentive
14:15:05 <nicktr> gkok: I agree. perhaps it also opens up new business models or payment methods - for example in open banking
14:16:22 <nicktr> evan_jacobs: some US issuers see authenticated transactions as inherently riskier than non-authenticated ones
14:16:25 <nicktr> q?
14:16:34 <nicktr> ack
14:16:36 <nicktr> ack nick_s
14:16:37 <nicktr> q?
14:17:03 <solai> solai has joined #wpwg
14:19:29 <nicktr> we break for coffee
14:19:45 <RRSAgent> I have made the request to generate https://www.w3.org/2023/09/11-wpwg-minutes.html nicktr
14:22:09 <benoit_> benoit_ has joined #wpwg
14:25:40 <bryanluo> bryanluo has joined #wpwg
15:00:28 <benoit_> benoit_ has joined #wpwg
15:00:35 <yoav_> yoav_ has joined #wpwg
15:02:18 <bryanluo> bryanluo has joined #wpwg
15:04:02 <Sami> Sami has joined #wpwg
15:04:07 <benoit_> benoit_ has joined #wpwg
15:04:19 <rwatkins-ma> rwatkins-ma has joined #wpwg
15:06:16 <alakatos> alakatos has joined #wpwg
15:06:39 <nick_s> nick_s has joined #wpwg
15:07:50 <Tony_E> Tony_E has joined #wpwg
15:08:55 <nicktr> Topic: Breakouts and future topics
15:09:32 <nicktr> nicktr: please note that the restaurant that we have a booking at this evening is here -> https://goo.gl/maps/D5VdQDoMwdbKhDwe7
15:09:54 <nicktr> https://aderezotapas.es
15:10:35 <nicktr> It's the El Porvenir one (about 15 minute walk from the Melia hotel)
15:29:29 <bryanluo> bryanluo has joined #wpwg
15:34:52 <nick_s> nick_s has joined #wpwg
15:39:02 <nick_s> nick_s has joined #wpwg
15:41:51 <nick_s> nick_s has joined #wpwg
15:44:44 <bryanluo> bryanluo has joined #wpwg
15:54:04 <nick_s> nick_s has joined #wpwg
15:54:57 <Gerhard> Group 1: Expanded payment use-cases
15:55:09 <Gerhard> Two categories: Non Payment Use-cases and complex usecase
15:55:15 <Gerhard> (Sami giving feedback)
15:55:25 <Gerhard> Second one was a broad discussion
15:55:35 <Gerhard> What should SPC have extra.
15:55:40 <Gerhard> Use-cases:Accessing
15:55:44 <Gerhard> * Accessing a wallet
15:55:59 <Gerhard> ID&V / enroll passkey (SPC) after legacy ID&V
15:56:19 <Gerhard> Can SPC fields be expanded for this?
15:56:25 <Gerhard> Complex use-cases was more divers.
15:56:35 <Gerhard> Payments + ID Data (e.g. age / location)
15:57:07 <Gerhard> * MAke Autofill and SPC make smoother together (Can we trust this/ binding this on the browser)
15:57:21 <Gerhard> * Recurring transactions (once a month/ initial + recurring, etc)
15:57:28 <Gerhard> Conclusions:
15:57:51 <Gerhard> * Bigger picture is important. SPC is being used is broader than the single part.
15:58:01 <Gerhard> Merchant + Network + Issuer.
15:58:08 <Gerhard> q?
15:58:53 <Gerhard> Payment & ID and Autofill was where a lot of time around this?
15:59:35 <Gerhard> Non Payment Auth has a ticket on it.
16:00:00 <Gerhard> Group 2: Increasing trust and reducing friction
16:00:10 <Gerhard> * Take lessons from FedCM
16:00:25 <Gerhard> They offer more context to the customer so dialog can show list or narrow it down.
16:00:36 <Gerhard> Also had a silent login option.
16:00:58 <Gerhard> Could we enrich the API so the relying party could share more information
16:01:35 <Gerhard> Next one was how we could add more browser data to the flow - influence on how the passkey/SPC asks for fingerprint.
16:02:01 <Gerhard> Potentially a risk score or additional signals that the browser could provide. Also potentially prompts to share consent
16:02:11 <Gerhard> Also potentialyl share biometric usage context (Still the same user)
16:02:19 <Gerhard> A notification that credentials are being used.
16:02:28 <imran> imran has joined #wpwg
16:02:51 <Gerhard> Also spoke about auto-enrollment? HOw could we do this, and what obstacles would be there. Create a credential without prompting? What would that take?
16:03:04 <Gerhard> IF you want to authenticate then use this.
16:04:05 <Gerhard> Context of the transaction such as pay/subscribe
16:04:18 <Gerhard> (nakjo for group 2)
16:04:34 <Gerhard> Group 3: INcrease trust and reduce friction:
16:04:56 <Gerhard> First ensure consistent experience for user accross all OS and Devices
16:05:03 <Gerhard> A couple of hops in that journey.
16:05:19 <Gerhard> Marketing and branding the payment brands and logos. Improve that.
16:05:27 <Gerhard> Experience enables consistency.
16:05:41 <Gerhard> Eliminating unneccessary steps due to failed authentication.
16:06:04 <Gerhard> Familiarity to uses in pop-ups. User names or something more memorable.
16:06:25 <Gerhard> Enrollment scope and cross-device scoping. Should not be repeating this across various devices.
16:06:29 <Gerhard> q?
16:06:48 <Gerhard> Group 4 (Stephen)
16:07:05 <Gerhard> Expanding use-cases to talk about SPC and non-payment flows and more complex payments.
16:07:16 <Gerhard> Also spoke about alternate payment mechanisms.
16:07:27 <Gerhard> Focused more on SPC UI.
16:07:39 <Gerhard> Technically it's too restricture (Recurring, variable)
16:07:58 <Gerhard> But you cannot do raw text in browsers? So how do you do that? FedCM has 4 enumerations.
16:08:13 <Gerhard> Payments may be more complex? Did not come up with a clear answer.
16:08:43 <Gerhard> How important is this to solve? Some are seeing issuers are not wanting to enable recurring payments - want to re-auth every time.
16:08:56 <Gerhard> Alternative payment: UPI, Open Banking, PayNow,
16:09:20 <Gerhard> (and PIX) Not all the same. Merchant is push payment. Open banking is submitting the context for them to charge.
16:09:40 <Gerhard> Obvious flows here are browser to app and back. How would we enable that.
16:09:48 <Gerhard> Did not really have a real solution here.
16:10:24 <Gerhard> What about Intents? PIX folks did raise concern since unsure about who responds to intends. Also based on time available /speed.
16:10:42 <Gerhard> Payment handler had ability to check signatures, so this can be solved.
16:10:48 <Gerhard> Alex had a complex idea.
16:11:39 <Gerhard> Action is to explore something - explore with RBI and Brazilian regulator. Also if SPC fits in there. Could you do everything in the browser.
16:13:12 <Gerhard> COmment: Would be great to jump back from app to browser page that redirected back to that.
16:13:24 <Gerhard> You should be able to solve this.
16:13:40 <Gerhard> (comments from gerhard)
16:14:54 <bryanluo> bryanluo has joined #wpwg
16:15:07 <alakatos> alakatos has joined #wpwg
16:15:29 <evan_jacobs> evan_jacobs has joined #wpwg
16:15:37 <Gerhard> Second point: Browser is trusted globally in the rest of the world. We can leverage that. Let the relying party indicate if he wants to trust the browser or not.
16:16:04 <Gerhard> New restaurant for tonight.
16:16:57 <nicktr> https://www.irccloud.com/pastebin/7XcD3zIq/
16:17:11 <nicktr> **Important**
16:17:11 <nicktr> 
16:17:11 <nicktr> Our restaurant booking has changed.
16:17:11 <nicktr> 
16:17:11 <nicktr> We are now heading to El Paseillo
16:17:12 <nicktr> 
16:17:12 <nicktr> https://elpaseillosevilla.com/
16:17:12 <nicktr> 
16:17:13 <nicktr> map - it looks like a 25 minute walk from the Melia hotel, but it is in a nice area of the city centre near the cathedral with lots of bars.
16:17:13 <nicktr> 
16:17:13 <nicktr> We have a reservation for 20 people across three tables at 8:30pm local time. I will be in reception at 8pm to walk over there if you want to walk with me.
16:20:58 <nicktr> s/Sami: are we trying/????: are we trying/
16:21:29 <nicktr> s/sami: we see lots/????: we see lots/
16:21:40 <nicktr> end of day one
16:21:57 <RRSAgent> I have made the request to generate https://www.w3.org/2023/09/11-wpwg-minutes.html nicktr
16:22:43 <Zakim> leaving.  As of this point the attendees have been Arman, benoit, canton, Stephen_McGruer, Helen_Qin, Rick_Byers, evan_jacobs, Dingwei_, bryanluo, gkok, nick_s, fahad, Melissa_VS,
16:22:43 <Zakim> Zakim has left #wpwg
16:22:43 <Zakim> ... JeanLuc, rwatkins-ma, westin, kenneth, SameerT_, Adam_, Gerhard, HelenQin, Dingwei, Tabitha, hari, Nakjo_Shishkov, Peter_, TEngland, Soumya, sioked, tomasz, Bastien_, :,
16:22:43 <Zakim> ... jonathan_grossar, Rouslan, martin_alvarez, Sami
16:24:08 <bryanluo> bryanluo has joined #wpwg
16:25:34 <benoit> benoit has joined #wpwg
16:51:46 <benoit_> benoit_ has joined #wpwg
18:00:38 <benoit> benoit has joined #wpwg
18:05:17 <benoit_> benoit_ has joined #wpwg
18:13:01 <bryanluo> bryanluo has joined #wpwg
18:20:37 <bryanluo> bryanluo has joined #wpwg
18:26:54 <bryanluo> bryanluo has joined #wpwg
20:26:37 <bryanluo> bryanluo has joined #wpwg
20:27:54 <benoit> benoit has joined #wpwg
21:06:29 <nick_s> nick_s has joined #wpwg
21:27:18 <bryanluo> bryanluo has joined #wpwg
21:32:47 <benoit> benoit has joined #wpwg
21:34:40 <benoit_> benoit_ has joined #wpwg
21:43:16 <benoit__> benoit__ has joined #wpwg
21:47:13 <benoit__> benoit__ has joined #wpwg
22:11:27 <benoit> benoit has joined #wpwg
22:46:02 <bryanluo> bryanluo has joined #wpwg
23:36:55 <benoit> benoit has joined #wpwg
23:56:38 <bryanluo> bryanluo has joined #wpwg