07:22:34 <RRSAgent> RRSAgent has joined #webauthn
07:22:34 <RRSAgent> logging to http://www.w3.org/2016/09/20-webauthn-irc
07:22:36 <trackbot> RRSAgent, make logs public
07:22:38 <trackbot> Zakim, this will be
07:22:38 <Zakim> I don't understand 'this will be', trackbot
07:22:39 <trackbot> Meeting: Web Authentication Working Group Teleconference
07:22:39 <trackbot> Date: 20 September 2016
07:22:58 <wseltzer> present=
07:23:01 <wseltzer> agenda=
07:23:07 <wseltzer> Agenda: https://public.etherpad-mozilla.org/p/webauthn-tpac-2016
07:23:18 <wseltzer> wseltzer has changed the topic to: Agenda 20 Sept. https://public.etherpad-mozilla.org/p/webauthn-tpac-2016
07:40:04 <yaronf> yaronf has joined #webauthn
07:40:46 <yaronf> @wseltzer: are you joining WebEX?
07:41:11 <yaronf> Thx!
07:41:47 <weiler> weiler has joined #webauthn
07:43:34 <yaronf> You are on WebEX but there's no audio.
07:48:27 <jcj_moz> jcj_moz has joined #webauthn
07:50:47 <rbarnes> rbarnes has joined #webauthn
07:50:51 <rbarnes> https://public.etherpad-mozilla.org/p/webauthn-tpac-2016
07:50:58 <alexei-goog> alexei-goog has joined #webauthn
07:51:08 <RobTrace> RobTrace has joined #webauthn
07:51:22 <mdadas> mdadas has joined #webauthn
07:51:27 <yaronf> I can hear you, but quality is real bad.
07:52:03 <JeffH> JeffH has joined #webauthn
07:52:12 <JeffH> present+
07:52:20 <rbarnes> sam agreed to scribe, but i don't see him here
07:52:36 <SamSrinivas> SamSrinivas has joined #webauthn
07:52:39 <weiler> present+
07:52:40 <nadalin> nadalin has joined #webauthn
07:52:42 <alexei-goog> present+
07:52:43 <rbarnes> present+
07:52:45 <SamSrinivas> present+_
07:52:48 <selfissued> selfissued has joined #webauthn
07:52:53 <SamSrinivas> Introductions by all.
07:52:59 <weiler> scribenick: SamSrinivas
07:53:01 <wseltzer> Topic: Spec updates from VGB
07:53:01 <SamSrinivas> Richard asks Vijay to give overview of status
07:53:05 <JeffH> SamS or SamW scribe?
07:53:14 <rbarnes> SamS
07:53:15 <JeffH> oh SamS
07:53:20 <nadalin> present+
07:53:30 <Rolf> Rolf has joined #webauthn
07:53:59 <SamSrinivas> Vijay giving big view: We are focusing on looking through end to end scenarios.
07:54:43 <rbarnes> relevant repo for those following along: https://github.com/w3c/webauthn
07:55:24 <SamSrinivas> One set of PRs is focuses on that. Two large issues in current list: (Issue 1) Attestation -- Rolf and Vijay discussing extensively (Issue 2) Origins --- what that means. Jeff has PR which does a lot of that.
07:55:44 <jcj_moz> present+
07:55:45 <SamSrinivas> (SamW, glad for you to take over -- let me know -- either way)
07:56:15 <gmandyam> gmandyam has joined #webauthn
07:56:25 <gmandyam> present+
07:56:33 <SamSrinivas> Vijay says: i18n folks asked us how we are doing -- some places where we need to pay attention -- prompt messages, internaationalized origin names (domian names).
07:56:34 <wseltzer> present+
07:56:54 <wseltzer> present+ yaronf(remote)
07:57:08 <wseltzer> zakim, who is here?
07:57:08 <Zakim> Present: JeffH, weiler, alexei-goog, rbarnes, _, nadalin, jcj_moz, gmandyam, wseltzer, yaronf(remote)
07:57:10 <Zakim> On IRC I see gmandyam, Rolf, selfissued, nadalin, SamSrinivas, JeffH, mdadas, RobTrace, alexei-goog, rbarnes, jcj_moz, weiler, yaronf, RRSAgent, mkwst, adrianba, slightlyoff,
07:57:10 <Zakim> ... Zakim, trackbot, wseltzer
07:57:13 <SamSrinivas> We have not had objections to the security model etc for a while -- meaning not fundamental structural issues. Vijay would like to get to implementations rolling.
07:57:16 <wseltzer> present- _
07:57:46 <wseltzer> present+ Ketan, nadalin, Rolf, selfissued
07:58:08 <Axel> Axel has joined #webauthn
07:58:19 <weiler> present+ SamSrinivas
07:58:21 <wseltzer> present+ Axel, RobTrace, vgb, dirkbalfanz
07:58:38 <SamSrinivas> Agenda bash. Afternoon Google people wants to talk about compatibility with issues, later afternoon accessibility issues discussion.
07:58:52 <SamSrinivas> sorry "google wants to talk about compatiblity with u2f".
07:59:05 <wseltzer> s/with issues/with u2f/
07:59:23 <SamSrinivas> Tony: We have to decide whether we want to WD-03 before we go with CR.
08:00:05 <SamSrinivas> Vijay: We should get to more frequent working drafts, perhaps every other week as we work through the existing issues after current pull requests -- there are 60 issues.
08:00:51 <SamSrinivas> Tony: Problem is that other groups watching us will complain about having to watch through frequent change. We should have milestones which 'external' people can invest in for review -- we should mark those in some way.
08:01:34 <SamSrinivas> Vijay:  Pull request convergence has become slow -- wiating times one month. We should have quicker cadence and frequent WD will force that.
08:01:48 <SamSrinivas> Tony: Let us now discuss open pull requests.
08:02:05 <rbarnes> https://github.com/w3c/webauthn/pull/161
08:02:12 <SamSrinivas> We have outstanding attestation PR #161 -- vijay and rolf?
08:03:01 <SamSrinivas> Rolf: Am happy in general with current status. Wouild like to get feedback on readability.
08:04:19 <SamSrinivas> Vijay: Downside of having it in PR means it is not in WD and so very limited set of peole reviewing it.  We should merge it in and there may be issues like incompletenees of TPM structure. But those are minor can can be fixed.
08:04:48 <SamSrinivas> Vijay: (Okes the pull request in real time)
08:04:55 <rbarnes> https://github.com/w3c/webauthn/pull/194
08:05:06 <SamSrinivas> Tony: #194 Transport Hints
08:05:09 <deiu> deiu has joined #webauthn
08:05:21 <brunoj> brunoj has joined #webauthn
08:06:16 <Sebastien> Sebastien has joined #webauthn
08:06:29 <SamSrinivas> Alexei:  is a narrative of what exactly client does with transport hints.
08:06:54 <SamSrinivas> Tony: Can you fix markup issues and merge it in?
08:07:07 <SamSrinivas> Alexei: I think that is what we should do.
08:07:17 <SamSrinivas> Jeff: The enum does not include plain Bluetooth
08:07:58 <SamSrinivas> Alexei: The reason is we didn't need it in U2F coz nobody wanted to implement it.
08:08:00 <SamSrinivas> Rolf: What are people using then?
08:08:24 <SamSrinivas> Alexei: Bluetooth Low Energy (as against classic Bluetooth)
08:08:24 <SamSrinivas> Tony: Alexei, you'll fix and create new issue?
08:08:24 <SamSrinivas> Alexei: Yes
08:08:47 <rbarnes> https://github.com/w3c/webauthn/pull/196
08:09:07 <SamSrinivas> Tony: #196: Few outstanding technical issues Vijay opened this morning
08:09:27 <SamSrinivas> Vijay: Need to be explicit about what errors are thrown in what situation. Havent' gotten a lot of feed back.
08:10:00 <SamSrinivas> Tony: Didn't Yaron ask about this?
08:10:12 <SamSrinivas> Vijay: No, he was talking about whether we have privacy leaks thrygh errors rather than what the error details are. That's my recollection.
08:10:13 <hyojin> hyojin has joined #webauthn
08:10:32 <SamSrinivas> Jeff: Question: Why do you call it scoped credential description and use the term 'descriptor'?
08:10:51 <SamSrinivas> Vijay: We will make it consistent to 'descriptor'
08:11:18 <SamSrinivas> Vijay: any other opinions?
08:11:22 <SamSrinivas> Room: Silence
08:11:49 <SamSrinivas> Tony: So will you close that out?
08:11:49 <SamSrinivas> Vijay: Will do it during the day today.
08:12:18 <rbarnes> https://github.com/w3c/webauthn/pull/198
08:13:41 <SamSrinivas> Richard:  What we are doing here is transitioning from the client computing the origin to it being speciied by the caller. Isn't that material change?
08:14:28 <SamSrinivas> Vijay: We are saying that the client will check what is specified and make sure it is permitted.
08:16:50 <SamSrinivas_> SamSrinivas_ has joined #webauthn
08:17:35 <SamSrinivas_> Mike: I'll review 201 right now.
08:19:04 <SamSrinivas_> SamSrinivas_ has joined #webauthn
08:19:09 <SamSrinivas_> Jeff: will resolve 202.
08:19:53 <SamSrinivas_> Tony: We have 203
08:20:00 <kaorumaeda> kaorumaeda has joined #webauthn
08:20:01 <SamSrinivas_> Jeff: This is simple, adds secure context qualifier to all interfaces in the API.
08:22:43 <rbarnes> https://github.com/w3c/webauthn/issues/6
08:23:20 <SamSrinivas> SamSrinivas has joined #webauthn
08:23:29 <rbarnes> https://github.com/w3c/webauthn/issues/8
08:23:32 <SamSrinivas> Brad: Security Context went to CR last week.
08:24:31 <SamSrinivas> Tony: We need to create a milestone (in response to Jeff). Next we have #53, error codes.
08:24:59 <SamSrinivas> VIjay: This will merge along with error code changes.
08:25:05 <SamSrinivas> Tony: We have #160
08:25:30 <SamSrinivas> Jeff: That is fixed.
08:25:36 <SamSrinivas> JC: Has reviewed, is ok.
08:26:04 <SamSrinivas> Dirk: What algorithm are using to jump between issues?
08:26:08 <SamSrinivas> Tony: All issues tagged with WD-02. We are trying to close those today.
08:26:41 <SamSrinivas> Tony: #173
08:27:14 <SamSrinivas> Jeff: Fixed in a pull request
08:27:27 <SamSrinivas> Tony: #174?
08:27:54 <SamSrinivas> Giri: I couldn't find it in the standard. It meant something else.
08:28:10 <SamSrinivas> Vijay: It has been renamed to 'origin'.
08:28:30 <SamSrinivas> Dirk: I'll close.
08:28:51 <SamSrinivas> Vijay: Don't close -- there is an outstanding PR.. Jeff's changes
08:29:12 <SamSrinivas> Dirk: which giant PR?
08:29:18 <SamSrinivas> Vijay: #202
08:30:04 <SamSrinivas> Tony: #178
08:30:54 <SamSrinivas> Jeff: Will close
08:31:07 <SamSrinivas> Tony: #179? Utf8 string?
08:31:29 <SamSrinivas> Jeff: I
08:31:42 <SamSrinivas> will fix this. But its not fixed rightnow.
08:32:01 <SamSrinivas> Tony: That takes through open WD-02 issues.
08:32:07 <SamSrinivas> Giri: #200?
08:32:29 <SamSrinivas> JC: It just got closed 5 minutes before.
08:33:04 <SamSrinivas> Tony: Will you do a republish?
08:33:09 <SamSrinivas> Vijay: Yes
08:33:19 <SamSrinivas> Richard: Is WD-02 closed for issues?
08:33:27 <SamSrinivas> Tony: Yes, issues will go against WD-03.
08:34:29 <SamSrinivas> Richard: 3 weeks between WD drafts. Anyone object?
08:34:44 <SamSrinivas> Vijay: Seems ok --- aligned with calls.
08:35:59 <SamSrinivas> Vijay: Hoping to get to last call within next few WDs.
08:36:11 <SamSrinivas> Richard: We have a CR milestone for Oct 31. Reminder.
08:36:28 <SamSrinivas> Alexei: Hiint; Get on a VPN and network issues go away.
08:40:34 <yaronf> yaronf has joined #webauthn
08:40:58 <SamSrinivas> Tony: Short break until network problems resolve.
08:41:08 <weiler_> weiler_ has joined #webauthn
08:50:38 <SamSrinivas> Vijay, Jeff: #12 -- assign to WD-03
08:51:04 <SamSrinivas> Vijay: #13 --may have addressed this already.
08:51:34 <SamSrinivas> Jeff: Vijay will reference this in a PR which will be merged
08:53:22 <SamSrinivas> Vijay: #22 -- we can put this beyond CR and do it in V2 of spec
08:55:54 <weiler_> weiler_ has joined #webauthn
08:59:09 <jcj_moz_> jcj_moz_ has joined #webauthn
09:00:18 <SamSrinivas> Sam, Alexei, Tony: Use case discussion: Authenticaiton required at remote machine. Authenticator present on local machine.
09:00:35 <SamSrinivas> Richard: Different point. Can there be a situaton where the test of user presence = 0.
09:00:56 <SamSrinivas> Giri: Example, presence of a TPM,
09:01:18 <SamSrinivas> Richard: We should have tesst of user presence =  0 as an option
09:02:29 <SamSrinivas> Vijay: We can just say "Set the bit to 1" in the spec and not handle it in v1 of spec.
09:02:47 <SamSrinivas> Vijay: Spec already says so.
09:05:19 <SamSrinivas> Jeff: We should put this in Level 2 (= v2).
09:05:24 <weiler> weiler has joined #webauthn
09:06:23 <yaronf> yaronf has joined #webauthn
09:06:28 <SamSrinivas> Vijay: Level is w3c terms which usually means 'version' elsewhere.
09:18:28 <weiler> weiler has joined #webauthn
09:21:28 <kaorumaeda> kaorumaeda has joined #webauthn
09:25:38 <kaorumaeda_> kaorumaeda_ has joined #webauthn
09:37:39 <RobTrace> RobTrace has joined #webauthn
09:37:50 <kaorumaeda> kaorumaeda has joined #webauthn
09:40:23 <kaorumaeda_> kaorumaeda_ has joined #webauthn
09:42:52 <kaorumaeda> kaorumaeda has joined #webauthn
09:44:38 <rbarnes> rbarnes has joined #webauthn
09:45:25 <jcj_moz> jcj_moz has joined #webauthn
09:46:00 <SamSrinivas> SamSrinivas has joined #webauthn
09:46:22 <SamSrinivas> Tony: Issue #24 hasn't had updates for a while
09:47:00 <SamSrinivas> Jeff: There are diagrams which need review
09:47:05 <SamSrinivas> Vijay: Will review
09:47:28 <SamSrinivas> Issue #25 Server challenge time out
09:47:47 <SamSrinivas> Vijay: That was addressed in one of my PRs, and when I check it in it should close.
09:48:05 <SamSrinivas> Tony: WIll be WD-02
09:49:12 <dsinger> dsinger has joined #webauthn
09:50:22 <yaronf> yaronf has joined #webauthn
09:52:08 <selfissued> selfissued has joined #webauthn
09:54:58 <SamSrinivas> Tony: There is a youtube video of paint drying.
09:55:07 <rbarnes> https://www.youtube.com/watch?v=nGA-GCq7JWM
09:55:22 <schuki> schuki has joined #webauthn
09:55:24 <rbarnes> https://github.com/w3c/webauthn/issues/66
09:55:27 <schuki> https://github.com/w3c/webauthn
09:55:28 <SamSrinivas> Mike: Which issue are we not discussing?
09:55:37 <SamSrinivas> Tony: Jeff on issue #66
09:55:49 <nadalin> nadalin has joined #webauthn
09:56:06 <nadalin> https://github.com/w3c/webauthn/issues/66
09:56:09 <SamSrinivas> Jeff: If someone agrees with my resolution close it.
09:56:31 <yaronf> yaronf has left #webauthn
09:57:06 <SamSrinivas> TOny: #79 has had not activity for a quite a whi.e
09:57:31 <SamSrinivas> Alexei: Leave it at CR
09:58:40 <SamSrinivas> Tony: #85?
09:59:03 <SamSrinivas> Vijay: non-normative -- can be in security considerations, is not affecting spec.
09:59:18 <SamSrinivas> not affecting normatively, that is.
10:01:17 <SamSrinivas> Tony: #87
10:01:30 <SamSrinivas> Vijay: wonder whether this is relevant any more
10:02:18 <Rolf> Rolf has joined #webauthn
10:04:20 <SamSrinivas> Vijay: Will change text to adjust to this
10:07:20 <dsinger> dsinger has joined #webauthn
10:09:52 <SamSrinivas> Tony: #91 could be a blocker for CR?
10:10:02 <SamSrinivas> JC: Would people vote no?
10:10:15 <SamSrinivas> JC: It is not normative.
10:10:21 <dsinger> dsinger has joined #webauthn
10:11:18 <jun> jun has joined #webauthn
10:11:24 <SamSrinivas> Vijay: This is about "how to write a server" and this is strange to have here.
10:11:49 <SamSrinivas> Dirk: I found the example this points to and that doc says "this explainer doc is out of sync with spec - read the spec instead"!
10:12:03 <SamSrinivas> Tony: Put in comments "Will address this post-CR"
10:12:29 <SamSrinivas> Richard: Well, this group is not chartered to do this, actually. Lets close this.
10:12:37 <SamSrinivas> Richard: Has been closed
10:13:12 <dsinger> dsinger has left #webauthn
10:14:54 <SamSrinivas> Vijay: #95will close.
10:29:17 <SamSrinivas> Vijay: #102 will be done by Vijay
10:31:53 <SamSrinivas> Alexei: #116 leave it open
10:37:17 <selfissued_> selfissued_ has joined #webauthn
10:49:45 <JeffH> JeffH has joined #webauthn
10:50:19 <SamSrinivas> Jeff: leave #125 open for CR
10:51:33 <SamSrinivas> RIchard: #131 is simple editorial word fix
10:51:49 <weiler> q+ re: post-lunch agenda
10:55:38 <SamSrinivas> #133 and #208 resolved togetehr with clarifying text. Giri to do it.
10:56:29 <gmandyam> gmandyam has joined #webauthn
11:03:03 <weiler> breaking for one hour , 'til 1pm local.  U2F at 1pm, followed by implementation.
11:12:52 <wseltzer> [closed the Webex]
11:50:02 <JeffH> JeffH has joined #webauthn
11:54:57 <jcj_moz> jcj_moz has joined #webauthn
12:02:20 <weiler> weiler has joined #webauthn
12:03:49 <rbarnes> rbarnes has joined #webauthn
12:04:04 <weiler> rrsagent, make minutes
12:04:04 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/20-webauthn-minutes.html weiler
12:04:19 <weiler> does anyone need or want WebEx?
12:09:40 <weiler> (WebEx is up and running, just in case.)
12:10:16 <RobTrace> RobTrace has joined #webauthn
12:16:48 <gmandyam_> gmandyam_ has joined #webauthn
12:17:39 <jcj_moz_> jcj_moz_ has joined #webauthn
12:32:39 <nadalin> nadalin has joined #webauthn
12:44:44 <crystal> crystal has joined #webauthn
13:16:09 <jun> jun has joined #webauthn
13:18:03 <weiler> weiler has joined #webauthn
13:19:12 <Sebastien> Sebastien has joined #webauthn
13:36:38 <harry> harry has joined #webauthn
13:38:51 <naomi> naomi has joined #webauthn
13:39:28 <Virginie_> Virginie_ has joined #webauthn
13:46:33 <crystal_> crystal_ has joined #webauthn
13:46:54 <crystal_> crystal_ has left #webauthn
13:48:42 <jcj_moz_> jcj_moz_ has joined #webauthn
13:49:02 <gmandyam> gmandyam has joined #webauthn
13:55:01 <kaorumaeda> kaorumaeda has joined #webauthn
13:59:08 <SamSrinivas> SamSrinivas has joined #webauthn
14:04:09 <harry> re extensions as long as there's no MUST/SHOULD normative text and it's clearly marked as extensions, should be fine
14:04:26 <harry> I think testing IdP/RP support is something W3C is not optimized for, but would be worth a discussion and I'm sure somehting reasonable is possible.
14:06:17 <brunoj> brunoj has joined #webauthn
14:07:57 <rbarnes> though i'm not really enthusiastic about having things specified that aren't implemented
14:12:34 <harry> agreed.
14:12:39 <harry> I think you'd have to argue for it.
14:13:27 <weiler> http://www.w3.org/2016/09/20-webauthn-minutes.html
14:13:36 <weiler> rrsagent, make minutes
14:13:36 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/20-webauthn-minutes.html weiler
14:13:56 <crystal> Thank you!
14:43:30 <weiler> weiler has joined #webauthn
15:13:13 <jcj_moz> jcj_moz has joined #webauthn
15:24:08 <naomi> naomi has joined #webauthn
15:26:15 <harry> q+
15:26:20 <harry> q- weiler
15:31:15 <harry> q+
15:42:39 <rbarnes> q?
15:42:44 <rbarnes> harry: you still in the queue?
15:43:42 <harry> nope
15:43:44 <harry> q- hhalpin
15:43:47 <harry> q- harry
15:50:46 <alexei-goog> alexei-goog has joined #webauthn
15:56:11 <weiler> weiler has joined #webauthn
16:11:43 <weiler> weiler has joined #webauthn
16:34:10 <rbarnes> https://ifaa.alipay.com/specifications.htm
16:34:29 <JeffH> JeffH has joined #webauthn
16:35:30 <JeffH> uri ?
16:36:31 <JeffH> https://ifaa.alipay.com/index.htm
16:38:54 <jcj_moz> https://ifaa.alipay.com/joinIndex.htm
16:52:04 <weiler> weiler has joined #webauthn
16:53:32 <rbarnes> rbarnes has joined #webauthn
17:09:26 <weiler> weiler has joined #webauthn
17:27:03 <rbarnes> rbarnes has joined #webauthn
17:34:19 <rbarnes> rbarnes has joined #webauthn
17:37:36 <rbarnes> rbarnes has joined #webauthn
17:50:40 <naomi> naomi has joined #webauthn
18:09:00 <harry> harry has joined #webauthn
19:16:21 <rbarnes> rbarnes has joined #webauthn
20:55:24 <kaorumaeda> kaorumaeda has joined #webauthn
21:24:55 <kaorumaeda> kaorumaeda has joined #webauthn
21:50:47 <kaorumaeda_> kaorumaeda_ has joined #webauthn
21:57:54 <kaorumaeda> kaorumaeda has joined #webauthn
22:42:59 <harry> harry has joined #webauthn