14:11:06 <RRSAgent> RRSAgent has joined #webauthn
14:11:06 <RRSAgent> logging to http://www.w3.org/2016/06/08-webauthn-irc
14:11:35 <wseltzer> zakim, clear agenda
14:11:35 <Zakim> agenda cleared
14:11:40 <wseltzer> present=
14:13:01 <wseltzer> trackbot, bye
14:13:01 <trackbot> trackbot has left #webauthn
14:13:04 <trackbot> trackbot has joined #webauthn
14:13:10 <wseltzer> trackbot, prepare meeting
14:13:10 <trackbot> Sorry, but no Tracker is associated with this channel.
14:13:29 <wseltzer> rrsagent, make logs public
14:13:41 <wseltzer> Meeting: Web Authentication WG
16:25:37 <Jean-Gui> Jean-Gui has joined #webauthn
16:26:09 <Jean-Gui> trackbot, prepare meeting
16:26:09 <trackbot> Sorry, but no Tracker is associated with this channel.
16:27:44 <Jean-Gui> trackbot, prepare meeting
16:27:46 <trackbot> RRSAgent, make logs public
16:27:48 <trackbot> Zakim, this will be
16:27:48 <Zakim> I don't understand 'this will be', trackbot
16:27:49 <trackbot> Meeting: Web Authentication Working Group Teleconference
16:27:49 <trackbot> Date: 08 June 2016
16:27:56 <Jean-Gui> tackbot end meeting
16:28:07 <Jean-Gui> trackbot end meeting
16:28:07 <trackbot> Zakim, list attendees
16:28:07 <Zakim> As of this point the attendees have been (no one)
16:28:15 <trackbot> RRSAgent, please draft minutes
16:28:15 <RRSAgent> I have made the request to generate http://www.w3.org/2016/06/08-webauthn-minutes.html trackbot
16:28:16 <trackbot> RRSAgent, bye
16:28:16 <RRSAgent> I see no action items
16:32:34 <RRSAgent> RRSAgent has joined #webauthn
16:32:34 <RRSAgent> logging to http://www.w3.org/2016/06/08-webauthn-irc
16:32:36 <trackbot> RRSAgent, make logs public
16:32:38 <trackbot> Zakim, this will be
16:32:38 <Zakim> I don't understand 'this will be', trackbot
16:32:39 <trackbot> Meeting: Web Authentication Working Group Teleconference
16:32:39 <trackbot> Date: 08 June 2016
16:34:25 <wseltzer> wseltzer has changed the topic to: WebAuthn 8 June https://lists.w3.org/Archives/Public/public-webauthn/2016Jun/0076.html
16:34:37 <wseltzer> agenda+  Roll Call
16:34:44 <wseltzer> agenda+ Agenda bashing
16:34:52 <wseltzer> agenda+ Extensions, extensions, and more
16:34:55 <wseltzer> agenda+ AoB
16:56:50 <jcj_moz> jcj_moz has joined #webauthn
17:00:30 <RobTrace> RobTrace has joined #webauthn
17:01:38 <apowers> apowers has joined #webauthn
17:01:59 <apowers> hi
17:04:01 <Rolf> Rolf has joined #webauthn
17:06:26 <vgb> vgb has joined #webauthn
17:06:41 <gmandyam> gmandyam has joined #webauthn
17:07:12 <JeffH> JeffH has joined #webauthn
17:07:14 <gmandyam> present+
17:07:15 <vgb> present+
17:07:16 <JeffH> present+
17:07:21 <jcj_moz> present+
17:07:30 <wseltzer> regrets+ wseltzer
17:08:13 <SamSrinivas> SamSrinivas has joined #Webauthn
17:08:20 <SamSrinivas> present+
17:08:55 <Rolf> present+
17:09:22 <Hubert-PayPal> Hubert-PayPal has joined #Webauthn
17:09:22 <jcj_moz> present+ alexei
17:09:46 <jcj_moz> agenda+ Discuss extensions
17:09:55 <Hubert-PayPal> present+
17:11:32 <SamSrinivas> Vijay: Big theme of recent discusison unprompted exyensions
17:11:46 <SamSrinivas> Shoudl autehnticator add them wihout prompting by RP
17:12:02 <SamSrinivas> Should user agents be in the position of gatekeeper -- this is a 2nd issue.
17:12:31 <SamSrinivas> we had agreed so far to mandate that one way or the other  -- clients could choose what they do.
17:13:24 <SamSrinivas> the 2nd issue seems to be settled to everyone's saatisfaciton more or less, but 1st issue (authenticaiton adding extension)
17:13:32 <SamSrinivas> is the one under active discussion
17:13:42 <SamSrinivas> (meta; Vijay speaking still)
17:14:45 <gmandyam> q+
17:15:02 <SamSrinivas> Proposal: RP would say "These are the extensions we would like".
17:15:15 <wseltzer> q-
17:16:22 <SamSrinivas> Jeff: I thyght we had agreed that the backstop for autehnticatior added extensions was certification testing (reputational recourse). Giri agrees.
17:16:31 <Rolf> q+
17:16:37 <JeffH> q?
17:17:20 <SamSrinivas> Giri: We don't have consensus. Vijay: Yes, we are in the process of discussing
17:18:06 <gmandyam> Giri:  There does not seem to be a way in the standard to preserve the packed attestation signature if the client starts stripping unprompted extensions.  This is problematic.
17:18:30 <SamSrinivas> Jeff metnioned ReputationaL Recourse via Certifcation. Vijay says: Certifiucation is not required, how do we handle that?
17:18:36 <JeffH> q+
17:18:38 <Rolf> q?
17:19:10 <SamSrinivas> Vijay: What is the case for unprompted extension if we were starting from scartch?
17:19:17 <SamSrinivas> Jeff: UVI extension.
17:20:32 <SamSrinivas> Jeff: Such extensions are in UAF.
17:20:48 <SamSrinivas> Jeff: Was used by a server and autehnticator being both from same vendor
17:21:58 <SamSrinivas> Jeff: They don't need to update front end on server -- hence we should have unprompted -- since RP will not need to query for it.
17:23:43 <SamSrinivas> Rolf: Unprompted extensions make sense since authenticator can put them in without expecting browser to understand it
17:24:12 <SamSrinivas> Rolf: I share the privacy concerns, but need to understand the threat model.
17:24:51 <SamSrinivas> Rolf: No way to get authenticator to be any particular way.
17:25:15 <JeffH> q?
17:25:18 <SamSrinivas> ROlf: we should only allow privacy presevring
17:29:14 <SamSrinivas> Sam: External authenticator may not knw the privacy constraint and in good faith violate it
17:29:53 <SamSrinivas> This is not theoretical -- there are vendors in this doscussion who may not be undestanding this distinciton.
17:30:29 <gmandyam> q+
17:30:52 <SamSrinivas> Vijay: Someone has to police auehtnicators which are privacy vilolating -- how willwe do that
17:31:43 <Rolf> q- Rolf
17:32:09 <SamSrinivas> Jeff: Things would work as they do now. There will be certification programs.
17:32:45 <SamSrinivas> Jeff: It is not 100% effective but nothing really is. We are trying to foster low friction innovation.
17:33:37 <SamSrinivas> Vijay: Who will police these?
17:34:25 <vgb> q+
17:36:53 <SamSrinivas> Giri: Things are problematic but dealing with them through the API is the way to go.
17:38:41 <JeffH> q?
17:39:05 <SamSrinivas> The browser can provide user prompts (giri)
17:40:08 <gmandyam> Giri:  providing visibility into granted permissions on an authenticator level is a current accepted best practice on the web.  Plenty of W3C standards can be used for privacy violations (e.g. Geoloc, EME).
17:40:39 <SamSrinivas> (speaker to be noted) If we do a reputational thing then user agents have to run white lists and black lists. Browsers are expected to try and protect users from poorly beahibg equipment.
17:40:47 <JeffH> q?
17:40:49 <SamSrinivas> Speaker was JC
17:40:52 <gmandyam> Giri:  The solution for most browsers is to provide the necessary prompts and request permissions on a per-domain basis.
17:41:59 <SamSrinivas> Vijay: Building on what Giri and JC said, if the browsre has to udnestand the extension and do sensible prompts, it has to have whitelists and blacklists. This would be high friction.
17:42:40 <JeffH> q+
17:42:47 <SamSrinivas> We should be able to allow a user to just "say no" to any privacy 'vioating' stuff and just use the basic autehnitcator. This will not be possible with unprmpted extenstions
17:44:15 <SamSrinivas> What if instead of unprompted extensions we baked them into the spec?
17:44:22 <SamSrinivas> (speaker = ...)
17:44:44 <SamSrinivas> Speaker JC
17:48:51 <SamSrinivas> Rolf: AAGUID can be part of attestation and give device ID
17:49:03 <Rolf> q+
17:49:27 <SamSrinivas> But having browser as police of extensions is impractical coz they all the various user agents have to agree on extensions which work
17:50:02 <SamSrinivas> Tony: its like being in the certificate root list for a browser -- a mechnism to get into all browsers
17:51:35 <JeffH> q+
17:53:56 <SamSrinivas> Jeff: user agent etc will implement whitelists
17:54:44 <Hubert-PayPal> Hubert-PayPal has joined #webauthn
17:55:55 <SamSrinivas> Jeff: UVI use case -- authenticator shold be able to say what kind of biometric was used
17:56:56 <Rolf> q+
17:58:12 <vgb> q+
18:00:05 <SamSrinivas> Sam: How can browsers even undestand how to whitelist or backlist? What is the information source?
18:00:26 <SamSrinivas> Rolf: Well, authencitaor may add unpromptec extensions anyway
18:00:41 <SamSrinivas> Sam: Wouldn't the browser then drop the entire transaction?
18:01:13 <SamSrinivas> Vijay: Whitelisting is very hard to do for browser vendors.
18:02:54 <SamSrinivas> Tony: We are not converging
18:03:19 <SamSrinivas> Viay proposal: Will try a draft making all unprompted exetsnsions into prompted extensi0ons
18:03:31 <Rolf> +1 for Vijay's proposal
18:04:12 <SamSrinivas> Giri: already has proposal for locaton, vijay take into consideration
18:59:39 <wseltzer> zakim, list attendees
18:59:39 <Zakim> As of this point the attendees have been gmandyam, vgb, JeffH, jcj_moz, SamSrinivas, Rolf, alexei, Hubert-PayPal
18:59:46 <wseltzer> zakim, bye
18:59:46 <Zakim> leaving.  As of this point the attendees have been gmandyam, vgb, JeffH, jcj_moz, SamSrinivas, Rolf, alexei, Hubert-PayPal
18:59:46 <Zakim> Zakim has left #webauthn
18:59:50 <wseltzer> rrsagent, make minutes
18:59:50 <RRSAgent> I have made the request to generate http://www.w3.org/2016/06/08-webauthn-minutes.html wseltzer