13:57:03 RRSAgent has joined #wpwg 13:57:07 logging to https://www.w3.org/2023/09/28-wpwg-irc 13:57:07 Meeting: Web Payments WG 13:59:06 Agenda: https://github.com/w3c/webpayments/wiki/Agenda-20230928 13:59:11 Scribe: Ian 14:01:06 Chair: Nick 14:01:09 present+ Ian 14:01:13 present+ Jeff_Owenson 14:01:22 present+ Steve_Cole 14:01:22 present+ Clinton_Allen 14:01:30 present Fahad_Saleem 14:01:38 present+ Tomasz_Blachowicz 14:01:45 present+ Jean-Michel_Girard 14:02:05 tomasz has joined #wpwg 14:02:11 +present 14:02:11 present+ Soumya_Chakrabarty 14:02:22 present+ Nick_Telford-Reed 14:03:12 JMGirard has joined #wpwg 14:04:21 Soumya has joined #wpwg 14:04:34 Regrets: Arman_Aygen 14:04:44 present+ 14:05:10 agenda+ TPAC recap 14:05:12 agenda+ Next meeting 14:05:15 zakim, take up item 1 14:05:15 agendum 1 -- TPAC recap -- taken up [from Ian] 14:05:53 Minutes from TPAC: 14:05:54 https://www.w3.org/2023/09/11-wpwg-minutes.html 14:05:57 https://www.w3.org/2023/09/12-wpwg-minutes.html 14:06:22 NickTR: With my chair hat on, overall success. Lots of participants in person and remote (though sound quality was not great). 14:06:30 present+ Olivier_Maas 14:07:09 present+ John_Bradley 14:07:44 NickTR: Genuine enthusiasm in sessions and in hallways. Some people may be aware that there was a small COVID outbreak (despite good mask wearing) 14:07:59 NickTR: Seville is a magnificent city. 14:08:42 NickTR: In terms of content, the highlight was seeing the results of experimentation from Stripe, Modirum, Netcetera, Visa...the fact that there was a list of findings was very exciting. 14:08:56 NickTR: I think it's clear from the findings (especially from Stripe) that they landed on quantitative findings similar to their first pilot. 14:09:16 ...there's real benefit of SPC for latency (3x faster compared to OTP) and in terms of authentication success. 14:09:46 ...but there remain challenges both to get users to register, and to get users to repeat the experience. Because it's new and changing user behaviors around payments is challenging. 14:10:54 ...we also heard in the latest Stripe findings that vanilla WebAuthn had a better success rate than SPC. Although Stripe did not offer a definitive analysis for why that was the case, there speculation (also supported by other conversations that week) was that, in an SPC experience the two pop-ups -- transaction dialog then OS dialog -- involved some friction, such as an extra click. 14:11:08 ...we started to discuss, for example, whether the dialogs might be merged. 14:11:23 ...Visa pointed out the UX is different on different platforms 14:11:44 ...involving different labels, different language, and that that was causing some confusing for the user. 14:12:36 ...even if we cannot specify UX (because our charter) it was valuable to talk about user journeys and we should continue to do so 14:12:48 ...we had a joint discussion with Web Authn WG and the WebAuthn adoption CG 14:13:32 ...the adoption CG's work was really interesting. It's clear to me that SPC represents a step forward in authentication during payments, but we have a mountain to climb to increase awareness with issuers and the broader community. 14:13:38 ...I think we need to be doing more to raise awareness. 14:13:56 ...do WG participants have views on how we might do so? 14:14:07 ...e.g., a new CG dedicated to that? a task force in this WG? via the WPSIG? 14:14:18 ...should we be relying on the companies who are participating in the groups? 14:14:27 ...by the platform providers? by EMVCo? 14:14:34 ...or some combination of all of the above? 14:15:40 IJ: John, any thoughts on marrying the dialogs? 14:16:17 John: I was not in the payments meetings, so did not participate in that discussion. There might be different solutions; it would depend on how SPC is specified and how it is implemented against WebAuthn. 14:16:36 ...it might be that the implementation layering doesn't communicate the consent from one to the other. 14:16:46 ...it could be a specification issue or an implementation issue. 14:18:29 NickTR: Another topic is whether more of SPC should be pushed into Web Authn. And what will happen after WebAuthn L3? 14:19:03 ...I have been wondering whether one of the ways we might get better alignment between SPC/WebAuthn is if more SPC were pushed to WebAuthn 14:19:21 John: I think that's a plausible idea 14:19:38 present+ Doug_Fisher 14:20:23 NickTR: There was an excitement about an SPC-style experience beyond the browser 14:21:02 ...so getting closer to native via FIDO is also somewhat interesting 14:21:55 I believe the discussion somehow relates to old issue we have on Github: https://github.com/w3c/secure-payment-confirmation/issues/56 14:22:17 Also -> https://github.com/w3c/secure-payment-confirmation/issues/12 14:23:04 John: I think there's more that could make its way into WebAuthn 14:23:11 q+ 14:23:28 Fahad has joined #wpwg 14:24:15 Present+ 14:24:24 ack tomasz 14:24:36 tomasz: This UX topic is very important 14:24:50 ...the fact that we have the two dialogs is cumbersome 14:24:52 q+ John 14:25:05 tomasz: There are two surfaces to the discussion 14:25:13 ...could be about implementation of SPC 14:25:21 ...could also be about alignment WebAuthn with SPC 14:25:44 ...this also relates to SPC-in-PR-API...and it may make more sense to ground SPC in WebAuthn 14:25:52 ..but what's important to us is the UX more than the API surface 14:25:53 ack JMGirard 14:25:56 ack John 14:26:16 John: If there were an extension to WebAuthn for the SPC dialog, perhaps the number of dialogs could be compressed. 14:26:23 And also the capability for a third party to trigger authentication 14:26:38 John: There's probably a fair amount of work to do that. Who is going to be displaying the transaction dialog/ 14:27:05 ...there's a separation between the platform providers and the pluggable passkey providers. We'd need to sort out who is doing what and trust boundaries. 14:27:12 ...but i think that's work worth doing. 14:27:25 ..if we want participation of FIDO folks in WPSIG; need to reschedule the meetings. 14:28:01 q? 14:28:59 NickTR: In terms of work product that this WG should do, I think this conversation about aligning webauthn and SPC, and figuring out how to have the discussion about UX and user journey while remaining in our charter scope, and figuring out how to drive adoption...those are the major topics for me. 14:29:16 NickTR: We did hear about the future a bit. For example, Rouslan talked about the payment links proposal. 14:29:29 ...Gerhard presented some non-payment use cases for SPC (e.g., storing payment credentials) 14:29:46 ...that's an increasingly important use case for both merchants and device / wallet provisioning. 14:30:09 ...On the Payment Request front, Google and Apple both want to add addresses back to the spec. 14:30:29 ...in short, I was excited by the pilots, by the breadth of participation 14:30:37 ..thanks to all the presenters from the meeting! 14:31:21 ...it was create to have Netflix at the meeting; the voice of the merchant is so important. 14:31:52 q? 14:31:53 ...and we should be thinking more about whether we can get more participation by Apple-as-merchant and google-as-merchant. 14:32:52 Ian: Good to have a list of things we should be doing to get to next level: 14:32:54 scribe: ian, nicktr 14:32:59 * UX feedback => changes in implementation 14:33:30 * More browser support 14:35:12 * Developer documentation 14:36:16 * IANA extension registration (done) 14:36:56 * Pilots and good data 14:37:29 * Outreach 14:37:44 * Support in protocols 14:39:23 q? 14:39:24 q+ 14:39:28 * More documentation? 14:39:32 Ian: That's a partial list of ideas 14:40:00 Clinton: On the UX feedback... what precedence is there in W3C about UX guidance? 14:42:04 IJ: Traditionally specs don't prescribe UX, but there is room to talk about user journeys and provided data to APIs. 14:42:16 John: The underlying WebAuthn UX is different on different platforms. 14:42:28 ...what may be annoying users is that the WebAuthn UX is different on each system. 14:42:38 ...WebAuthn WG similarly doesn't tell OS's how to do their dialogs 14:43:20 ...I think browser may be able to do more to get cross-OS consistency for the SPC portion of UX 14:45:47 ack clinton 14:46:35 IJ: I think there are fewer implementers here, and they are strongly motivated by pilot feedback to fix UX; I think that is potentially more powerful than guidelines. 14:47:53 NickTR: yes, Doug++ for his UX presentation 14:49:22 John: We also need to keep an eye on the changes to WebAuthn that are happening, such as pluggable providers 14:49:45 ...e.g., on MacOs or Windows, if you are using Chrome and having a password manager installed, the password manager may "take over" 14:50:01 ...small number of UX people today, but it will be increasing 14:51:20 ...credentials in password managers aren't available (at least now) via the credential listing APIs. 14:52:11 ...we need people to understand that APIs that password managements can plug into need to also make affordances for SPC. 14:53:04 ACTION: John to raise an SPC issue related to pluggable passkey provider APIs 14:53:20 q? 14:54:39 Clinton: UX is becoming the obvious hurdle for adoption (for many different specifications, not just W3C) 14:54:59 ...it's one experience from the consumer perspective; even if there are different responsible parties working together 14:56:33 +1 for the UX workshop 14:57:24 IJ: SHould we do a UX Workshop on payments? 14:57:31 Clinton: +1 ; good to speak with one voice 14:58:27 Doug: +1 14:58:47 zakim, close this item 14:58:47 agendum 1 closed 14:58:47 I see 1 item remaining on the agenda: 14:58:47 2. Next meeting [from Ian] 14:58:51 zakim, take up item 2 14:58:51 agendum 2 -- Next meeting -- taken up [from Ian] 14:58:55 Next meeting 12 October 14:59:01 I have made the request to generate https://www.w3.org/2023/09/28-wpwg-minutes.html Ian 15:02:44 rrsagent, bye 15:02:44 I see 1 open action item saved in https://www.w3.org/2023/09/28-wpwg-actions.rdf : 15:02:44 ACTION: John to raise an SPC issue related to pluggable passkey provider APIs [1] 15:02:44 recorded in https://www.w3.org/2023/09/28-wpwg-irc#T14-53-04 15:02:45 zakim, bye 15:02:45 leaving. As of this point the attendees have been Ian, Jeff_Owenson, Steve_Cole, Clinton_Allen, Tomasz_Blachowicz, Jean-Michel_Girard, present, Soumya_Chakrabarty, 15:02:45 Zakim has left #wpwg 15:02:48 ... Nick_Telford-Reed, nicktr, Olivier_Maas, John_Bradley, Doug_Fisher, Fahad