13:58:56 RRSAgent has joined #wpwg 13:59:00 logging to https://www.w3.org/2024/04/25-wpwg-irc 13:59:00 Meeting: Web Payments Working Group 13:59:12 Gregoire has joined #wpwg 13:59:19 Yannick has joined #wpwg 13:59:23 Agenda: https://github.com/w3c/webpayments/wiki/Agenda-20240425 13:59:28 Scribe: Ian 13:59:32 present+ Anne_Pouillard 13:59:35 present+ 13:59:40 present+ Tomsaz_Blachowicz 13:59:43 present+ Hari 13:59:48 present+ Jeff_Owenson 13:59:50 Hari has joined #wpwg 13:59:53 present+ Roberio_Matsui 14:00:04 present+ Kenneth_Diaz 14:00:10 present+ Grégoire_Leleux 14:00:38 agenda+ Issue 269 on Limitations for showing transaction data 14:00:41 agenda+ Chrome updates 14:00:49 agenda+ Ideas on support for roaming authenticators 14:00:54 present+ Next meeting 14:01:02 agenda+ Next meeting 14:01:14 JL has joined #wpwg 14:01:26 present+ Fahad 14:01:37 present+ Stephen_McGruer 14:01:53 present+ Yannick_Seveant 14:01:59 present+ Gustavo_Kok 14:02:04 present+ Doug_Fisher 14:02:10 present+ Vipul_Koul 14:02:16 present+ Steve_Cole 14:02:22 present+ Nick_Telford-Reed 14:02:38 present+ Imran_Ahmed 14:02:50 I have made the request to generate https://www.w3.org/2024/04/25-wpwg-minutes.html Ian 14:02:54 present+ Gerhard_Oosthuizen 14:03:18 zakim, take up item 1 14:03:18 agendum 1 -- Issue 269 on Limitations for showing transaction data -- taken up [from Ian] 14:03:21 -> https://github.com/w3c/secure-payment-confirmation/issues/269 Issue 269 14:03:30 Limitations for showing transaction data 14:03:40 present+ Michael_Horne 14:03:44 present+ Arman_Aygen 14:03:47 present+ Sameer_Tare 14:04:04 Stephen: We were contacted on this spec issue. We have multiple strings that can be displayed to the user. 14:04:08 present+ Ravi_Shekhar 14:04:27 Stephen: Question was "what are the limitations on this string" (e.g., newlines) 14:04:36 present+ Jean-Michel_Girard 14:04:48 Stephen: We should specify this in some way. I looked at WebAuthn. 14:05:22 ...WebAuthn has no normative spec text; it just specifies that the user agent may truncate the display (even if the full string is sent to the authenticator) 14:05:38 ...I think we all expect essentially 1-liner text. 14:05:45 ... I also plan to look at the FedCM spec 14:06:01 Ian: How does 3DS handle this sort of thing? 14:06:04 In 3DS: Length: Variable, maximum 40 characters. Type: String Same name used in the authorisation message as defined in ISO 8583-1 14:06:18 q+ 14:06:22 NickTR: I think field lengths are commonly defined in specifications. 14:06:27 ack Jean 14:06:47 Imran has joined #wpwg 14:06:47 jmgirard has joined #wpwg 14:07:09 Gregoire has joined #wpwg 14:07:10 Jean-Luc: One reason for 40 char length is downstream requirements (ISO) related to those strings 14:07:20 zakim, who's here? 14:07:20 Present: Anne_Pouillard, Ian, Tomsaz_Blachowicz, Hari, Jeff_Owenson, Roberio_Matsui, Kenneth_Diaz, Grégoire_Leleux, Next, meeting, Fahad, Stephen_McGruer, Yannick_Seveant, 14:07:23 ... Gustavo_Kok, Doug_Fisher, Vipul_Koul, Steve_Cole, Nick_Telford-Reed, Imran_Ahmed, Gerhard_Oosthuizen, Michael_Horne, Arman_Aygen, Sameer_Tare, Ravi_Shekhar, Jean-Michel_Girard 14:07:23 On IRC I see Gregoire, jmgirard, Imran, JL, Hari, Yannick, RRSAgent, Zakim, Anne, pea1358, canton, dlehn, slightlyoff, hober, ljharb, smcgruer_[EST], rouslan, hadleybeeman, tobie_, 14:07:23 ... nicktr, rbyers, Ian 14:07:42 Arman has joined #WPWG 14:07:51 Doug: I wonder about the reverse: would SPC display something that is allowed by 3DS? 14:08:02 Stephen: For images, yes (e.g., resizing a 6K image) 14:08:24 SameerT has joined #wpwg 14:08:24 Stephen: Does EMVCo spec say anything about newlines? 14:08:31 present+ 14:08:40 Doug: All ASCII characters are allowed (including NL) 14:09:05 Tomasz: SRC spec defines similar elements (e.g., names, etc.) and usually 255 characters long 14:09:44 ...in WebAuthn there are name/display name. The spec is nice and specifies a minimum length that the authenticator is able to accept. But authorizes the authenticator to truncate. 14:09:57 ...it's ok if the information is truncated. 14:10:01 https://w3c.github.io/webauthn/#sctn-strings-truncation 14:10:55 Ian: I would not support disparity between what is displayed and what is sent to the authenticator (unless there's a signal that something was truncated). 14:11:08 (We look more closely at the WebAuthn spec definitions.) 14:11:16 present+ Melissa_Sebastian 14:11:21 https://w3c.github.io/webauthn/#dom-publickeycredentialuserentity-displayname 14:11:27 "Authenticators MUST accept and store a 64-byte minimum length for a displayName member’s value. Authenticators MAY truncate a displayName member’s value so that it fits within 64 bytes. See § 6.4.1 String Truncation about truncation and other considerations." 14:11:41 Tomasz: When more data is provided, it's not an error, but gives authenticators a way to deal with it by truncating. 14:11:57 Dfisher has joined #wpwg 14:12:19 Ian: Does it suffice to point to WebAuthn? 14:12:29 Stephen: Not for some fields 14:13:05 q+ 14:13:29 melissavs has joined #wpwg 14:13:44 Stephen: I am thinking of doing this: define a minimum that will be guaranteed, allow user agent to truncate; send truncated info to authenticator. 14:14:00 ack J 14:14:08 q? 14:14:30 SameerT has joined #wpwg 14:14:30 Jean-Luc: We may also need to look in to other downstream flows (e.g., ISO 20022) 14:14:48 q+ 14:15:03 ack N 14:15:17 nicktr: ISO 20022 is more verbose in general than 8583. 14:15:46 ...8583 would cover us for "old school" payments. 40 characters for payer, amount. 3 for currency 14:16:08 ...I would advocate for going small to start an expending as the industry requires. 14:17:20 Stephen: What minimum would be acceptable? I'm hearing 40 14:17:40 NickTR: Let's reflect the lengths found in the 3DS integration. 14:17:53 ....they've done the lifting. 14:17:59 Kudos to Nick on using the full version of the 3DS spec :) 14:18:39 ACTION: Stephen to create a pull request re: issue 269 leveraging EMVCO 3DS values. 14:18:51 Stephen: For PR API the currency is ISO 3-letter code 14:19:16 ...value is a valid decimal monetary value. 14:19:55 [We pause to note that PR API does not allow commas in currency values] 14:20:04 Tomasz: UA should format according to localization preferences 14:21:10 ack Gu 14:21:35 Gustavo: EMVCo has solved for some of this. 14:21:43 kenneth has joined #wpwg 14:21:58 The 3DS 2.3.1.1 specification can be downloaded from here -> https://www.emvco.com/specifications/emv-3-d-secure-protocol-and-core-functions-specification-6/ 14:22:07 zakim, close item 1 14:22:07 agendum 1, Issue 269 on Limitations for showing transaction data, closed 14:22:09 I see 3 items remaining on the agenda; the next one is 14:22:09 2. Chrome updates [from Ian] 14:22:17 zakim, take up item 2 14:22:17 agendum 2 -- Chrome updates -- taken up [from Ian] 14:22:20 q? 14:22:56 Stephen: Here are some updates on design iterations. 14:23:23 ...we are still looking for feedback. This is intended to be iterative! 14:23:34 ...some feedback we've received is not yet in the deck 14:24:40 rrssgent, make minutes 14:24:43 rrsgent, make minutes 14:24:48 rrsagent, make minutes 14:24:49 I have made the request to generate https://www.w3.org/2024/04/25-wpwg-minutes.html Ian 14:25:03 Regrets+ Juliana_Cafik 14:25:48 Stephen: We want to display issuer/network logos but without having them take over the UX 14:25:52 ...text copy is draft 14:26:18 ...we are looking at "authenticate another way" in the footer. 14:26:37 This is where "opt-out" appears today, but nobody is using opt-out actively today. Our current proposal is to remove opt-out concept from the spec. 14:26:51 ...we need to hear from you whether opt-out experience is necessary. 14:26:54 q+ to talk about network and issuer labels and implications for routing/regulation 14:26:58 ack nick 14:26:58 nicktr, you wanted to talk about network and issuer labels and implications for routing/regulation 14:27:09 nickTR: This is great; love the clean design. 14:27:24 ...I want to wonder aloud about labels" Issuer" and "network" 14:27:35 q+ 14:27:51 ...also, what are the implications for jurisdictions where there might be a choice of routing? 14:27:51 q? 14:27:57 q+ Gerhard 14:27:59 q+ Hari 14:28:41 Hari has joined #wpwg 14:28:44 Stephen: Nick is right; this is some of the first feedback we heard (re labels); this needs to be more flexible. 14:28:59 ...we do expect this information overall to be optional. 14:29:11 ack Se 14:29:11 ack Sa 14:29:36 gkok has joined #wpwg 14:29:39 q+ 14:29:49 Sameer: The "network" and "issuer" labels may change in some markets; when it's optional and one logo is displayed, how would it appear? 14:30:14 ...some logos may not appear as recognizable if you have a longer issuer name 14:30:48 Sameer: Going back to opt-out. We think that opt-out during authentication is confusing (from a 3DS WG perspective) 14:30:52 ack Ge 14:31:37 Gerhard: There are different use cases (e.g., card, open banking, generic) and might adjust labels based on the accepted terminology and even layout of the use case. 14:31:45 ..there are probably 15-20 such layouts in the world. 14:32:08 ...regarding opt-out, it's tied to the signals available from the dialog. 14:33:03 Gerhard: SPC can be used in 2 contexts: issuer-initiated and merchant-initiated. In the former case, if the user is already on the bank page, then saying "authenticate to your bank" is confusing. 14:33:25 ...if there are better signals overall, might make it ok to remove opt-out. 14:33:36 ...also, the display might need to change based on 1p or 3p call of SPC 14:33:54 q+ Sameer 14:35:13 Gerhard: Ah, now that I understand opt-out, +1 to removing it from the dialog 14:35:17 q? 14:35:24 ack Hari 14:35:25 Opt Out today https://usercontent.irccloud-cdn.com/file/cH5vhIc6/opt_out.png 14:35:48 Hari: From end user perspective, I don't have a clear idea of how is authenticating me 14:36:00 ...if we are bringing a PSP into the mix, how is that information shown? 14:37:23 Stephen: the problem we ran into with "who is doing the authenticating" 14:37:33 ...the URLs are not often understandable to users. 14:37:53 ...(Ian adds: and not trustable to put the name of the party) 14:38:32 ACS on behalf of the issuer to be precise 14:38:33 ...often 3DS challenge flows are doing by ACS's on behalf of banks. 14:38:55 ....if we are talking about passkeys, what you want is the passkey owner name 14:39:03 q? 14:39:12 ack gkok 14:39:45 gkok: What happens when transaction is tokenized? 14:40:10 Stephen: All the information comes from the caller and will be optional. 14:40:43 q? 14:40:47 ack Sam 14:41:12 Sameer: Regarding ACS Url, in most implementations the cardholders want to see the URLs, even if different than the URL of the issuer. 14:41:50 ...rearding Gustavo's point, in the 3DS structure, the SPC input is being provided by the issuer. 14:42:07 Ravi has joined #wpwg 14:44:31 q+ 14:45:08 IJ: Is it preferable to show confusing URL v. nothing? 14:45:48 Stephen: The question is whether the "on behalf of" info info should be in the tx dialog in addition to the webauthn dialog. 14:46:19 q? 14:46:21 Here, rsolomakhin.github.io is the relying party https://usercontent.irccloud-cdn.com/file/gu2A4Y8q/webauthn_macos_dialog.png 14:46:33 Ian: what if tx dialog has clue that info will be on the next screen? 14:46:35 ack gkok 14:46:51 gkok: I am wondering how much of an issue this is; we may just need to test on this. 14:47:45 Stephen: We have not explored whether SPC should ping the RP directly during the flow at a .well-known URL. We could be much more confident what name to provide. 14:47:57 dfisher has joined #wpwg 14:48:35 Ian: Maybe lazy (only if user wants to know.) 14:48:36 q? 14:49:08 I have made the request to generate https://www.w3.org/2024/04/25-wpwg-minutes.html Ian 14:53:21 (Stephen also talks about some UX options that were rejected.) 14:54:19 Stephen: e.g., logos from network and issuer at top were perceived as overly branded for browser-owned UX 14:54:39 q+ 14:54:39 q? 14:54:43 ack gk 14:55:42 zakim, take up item 3 14:55:42 agendum 3 -- Ideas on support for roaming authenticators -- taken up [from Ian] 14:55:46 https://www.w3.org/2024/Talks/ij-roaming-20240425/ij-roaming-20240425.pdf 14:58:44 I have made the request to generate https://www.w3.org/2024/04/25-wpwg-minutes.html Ian 14:59:01 Nick: I think a longer discussion of this should happen at next call 14:59:12 zakim , close item 3 14:59:14 zakim, take up item 4 14:59:14 agendum 4 -- Next meeting -- taken up [from Ian] 14:59:19 Next: 9 May 14:59:22 RRSAGENT, make minutes 14:59:23 I have made the request to generate https://www.w3.org/2024/04/25-wpwg-minutes.html Ian 14:59:32 RRSAGENT, set logs public 14:59:44 melissavs has left #wpwg 15:00:59 Gregoire has left #wpwg 15:58:04 TallTed has joined #wpwg