09:58:09 <RRSAgent> RRSAgent has joined #https-local
09:58:09 <RRSAgent> logging to http://www.w3.org/2016/09/21-https-local-irc
09:58:30 <Tomoyuki> rrsagent, start a new log
09:59:11 <Tomoyuki> rrsagent, make logs public
09:59:27 <Tomoyuki> rrsagent, make minutes
09:59:27 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/21-https-local-minutes.html Tomoyuki
10:02:24 <kaorumaeda> kaorumaeda has joined #https-local
10:02:24 <junichi-hashimoto> junichi-hashimoto has joined #https-local
10:02:47 <dajiaji> dajiaji has joined #https-local
10:03:10 <matsuo> matsuo has joined #https-local
10:03:16 <Zakim> Zakim has joined #https-local
10:03:32 <mdadas> mdadas has joined #https-local
10:03:33 <takeshi> takeshi has joined #https-local
10:03:40 <Tomoyuki> Present+ Tomoyuki_Shimizu
10:03:52 <ajitomi> ajitomi has joined #https-local
10:04:04 <kaorumaeda> present+ Kaoru_Maeda
10:06:32 <kaz> kaz has joined #https-local
10:06:48 <kaz> rrsagent, make log public
10:06:50 <kaz> rrsagent, draft minutes
10:06:50 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/21-https-local-minutes.html kaz
10:07:39 <hyojin> hyojin has joined #https-local
10:07:56 <Hiroki> Hiroki has joined #https-local
10:08:35 <Tomoyuki_> Tomoyuki_ has joined #https-local
10:08:45 <mfoltzgoogle> mfoltzgoogle has joined #https-local
10:08:54 <annevk> annevk has joined #https-local
10:09:00 <MikeSmith> MikeSmith has joined #https-local
10:09:02 <tidoust> tidoust has joined #https-local
10:09:04 <kaorumaeda> Tomoyuki: Gives intros
10:09:11 <gmandyam> gmandyam has joined #https-local
10:09:57 <kaorumaeda> ... Smart TVs, set-top boxes have HTTP services in home networks.
10:10:24 <satoshin> satoshin has joined #https-local
10:10:26 <kaorumaeda> ... HTTP and WebSockets without TLS are considered non-secure and have some problems.
10:10:35 <wonsuk_ETRI_> wonsuk_ETRI_ has joined #https-local
10:10:45 <tidoust2> tidoust2 has joined #https-local
10:11:08 <kaorumaeda> ... How can we access these in-home servers in HTTPS?
10:11:11 <igarashi> igarashi has joined #https-local
10:11:30 <kaz> i/Tomoyuki:/scribenick: kaorumaeda/
10:11:30 <ying_ying> ying_ying has joined #https-local
10:12:11 <kaz> Meeting: HTTPS Migration in Local Network Breakout
10:12:15 <kaorumaeda> ... Goals in this session: Clarify motivation, share difficulties, collect ideas, provision a community group
10:12:19 <kaz> Agenda: https://www.w3.org/wiki/TPAC2016/SessionIdeas#HTTPS_Migration_in_Local_Network
10:13:19 <vivien> vivien has joined #https-local
10:13:22 <Tomoyuki_> topic: HTTPS Migration in Local Network
10:13:27 <kaorumaeda> Junichi presents HTTPS Migration in Local Network
10:13:31 <kiyoshi> kiyoshi has joined #https-local
10:13:32 <Tomoyuki> https://www.w3.org/wiki/images/4/43/Http-migration-in-local-network.pdf
10:13:34 <kajimoto> kajimoto has joined #https-local
10:14:00 <mkwst> mkwst has joined #https-local
10:14:05 <kaorumaeda> Junichi: related sessions 2014 WoT devices, 2015 ??
10:15:02 <kaorumaeda> ... Use case: vehicle API exposes car signals (speeds, rpm, etc.)
10:15:16 <urata_access> urata_access has joined #https-local
10:15:17 <hamid> hamid has joined #https-local
10:15:47 <kaorumaeda> ... Introducing local server to provide APIs. Easier implementation and access control
10:16:33 <kotakagi> kotakagi has joined #https-local
10:17:36 <kaorumaeda> ... Use case 2: Local video storage.  A web page from a cloud service wants to access local video storage.  This is a cross origin access. Problems with TLS and DNS lookup arise
10:19:16 <kaorumaeda> ... PLEX's solution: Local server announces it's local IP address to cloud application server. Application server tells the local server URL (with embedded IP address) to the browser.  Browser looks up DNS that in turn returns local IP address
10:19:57 <kaorumaeda> ... Local server has a cert whose CN is *.id.example.com
10:20:39 <kaorumaeda> ... CA/Browser forum guidance deprecates local IP like 192.168.*.* as Common Name.
10:21:14 <Pen> Pen has joined #https-local
10:21:24 <ohsumi> ohsumi has joined #https-local
10:21:58 <kaorumaeda> ... PLEX's solution has a public DNS that returns local IP address.
10:22:48 <kaorumaeda> @@: This would be acceptable by the guidance. Common Name looks like a public address.
10:22:59 <kaz> s/@@:/Brad:/
10:23:28 <Karima> Karima has joined #https-local
10:23:53 <Hiroki_> Hiroki_ has joined #https-local
10:24:17 <FINDIX> FINDIX has joined #https-local
10:25:11 <kaorumaeda> Brad: The point of the guide is when looking up 'mail' that returns different certs in different environment.
10:25:57 <kaorumaeda> Joe: Think which of public PKI and private CA case?
10:26:12 <kaorumaeda> Junichi: both, but for this session public.
10:26:51 <kaorumaeda> Junichi: So far we don't have enough support for local device certificates.
10:27:25 <kaorumaeda> ... We want better solution than PLEX's.  For privacy, discovery, and management purposes.
10:28:44 <gmandyam> present+
10:28:48 <gmandyam> q+
10:29:07 <kaorumaeda> ...  Different stakeholders take care of different subsets of the participants in Internet to private network picture.
10:30:46 <kaorumaeda> @@: You can have trusted association between local devices and private certs can work
10:31:20 <nunoken1> nunoken1 has joined #https-local
10:31:48 <kaorumaeda> Junichi: I don't reject that. We want simpler solution.
10:32:22 <kaorumaeda> Tatsuya: We introduced the problem and want as many solutions.
10:32:28 <gmandyam> q-
10:33:37 <Tomoyuki> topic: Local Network Discovery and HTTPS
10:33:37 <kaorumaeda> Tatsuya: Addresses problem of discovery of local device
10:33:50 <Tomoyuki> https://www.w3.org/wiki/images/6/6c/TPAC2016_Local_Discovery_and_HTTPS.pdf
10:33:56 <ying_ying> s/@@/Giridhar/
10:34:18 <kaorumaeda> ... UA can have local CA's certificates (or self-signed) if well-managed locally.
10:34:44 <kaorumaeda> ... However W3C standards like CORS doesn't like Mixed Contents or self-signed certs.
10:34:55 <annevk> (FWIW, CORS doesn't require HTTPS, but the point he made stands.)
10:35:03 <kaorumaeda> ... Local network traffic should be encrypted as well.
10:35:38 <kaorumaeda> ... Straw Man solution.  Use TLS server certs with FQDN and public DNS for LAN devices.
10:36:34 <kaorumaeda> ... The idea as that the local device registers LAN address FQDN to a dynamic DNS server
10:37:33 <kaorumaeda> ... local mDNS respond CNAME to the (public) dynamic DNS server
10:39:53 <kaorumaeda> ... Use case local media server page can be displayed in WebView.  EME in Secure Context is possible.
10:40:33 <kaorumaeda> ... Use case 2: Presentation API discovery is possible.
10:41:38 <kaz> kaz has joined #https-local
10:41:49 <kaz> rrsagent, draft minutes
10:41:49 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/21-https-local-minutes.html kaz
10:42:41 <kaz> Chair: Tomoyuki_Shimizu
10:42:51 <kaz> present+ Kaz_Ashimura(W3C), Kaoru_Maeda(Lepidum), Junichi_Ajitomi(Toshiba), Tomoyuki_Shimizu(KDDI), Giri_Mandyam(Qualcomm), Tatsuya_Igarashi(Sony), Tomohiro_Yamada(NTT), Kiyoshi_Tanaka(NTT)
10:42:58 <kaz> present+ Matsuo_Suzuki(SoftBank), YounJae_Shin(SoftBank), Hamid_Amir_Alikhani(Panasonic), Licheng_Yin(Qihoo360), Francois_Daoust(W3C), Yves_Lafon(W3C), Mike_West(Google), Mike_Smith(W3C), Brad_Hill(Facebook), Jiajia_Li(Alibaba), Rouslan_Solomakhin(Google)
10:43:04 <kaz> present+ Joe_Hall(Center_for_Democracy_and_Technology), Mohammed_Dadas(Orange), Jin_Peng(China_Mobile), Yingying_Chen(W3C), Olive_Xu(W3C), Kazuhiro_Hoya(J-BA)
10:43:49 <kaorumaeda> Brad: CNAME approach could be problematic because trust between DNS servers is not enough
10:44:10 <kaorumaeda> @@: mDNS in public Wifi can be easily spoofed
10:44:19 <kaorumaeda> s/@@/Cullen/
10:44:53 <Tomoyuki> topic: “.local” Server Certificate for HTTPS migration on local network
10:45:01 <Tomoyuki> https://www.w3.org/wiki/images/3/37/2016.w3c.breakout_session.dot-local-server-cert.p.pdf
10:45:08 <kaorumaeda> Daisuke presents ".local" server certificate
10:46:44 <kaorumaeda> Daisuke: Use case: local media cache server. VoD service offers local media cache for the browser.
10:47:13 <kaz> present+ Claes_Nilsson(Sony), Jatinder_Mann(Microsoft), Yoshiaki_Ohsumi(Panasonic), Kazuo_Kajimoto(Panasonic), Takeshi_Kanai(Sony), Cullen_Jennings(Cisco), Ari_Keranen(Ericsson), Carsten_Bormann(TZI), Toshihiko_Yamakami(ACCESS)
10:47:49 <kaorumaeda> ... Problem: it's mixed content.  Can't issue valid server certificates to local devices.
10:47:53 <Tomoyuki> rrsagent, draft minutes
10:47:53 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/21-https-local-minutes.html Tomoyuki
10:48:45 <kaorumaeda> ... User cannot have an opportunity to authorize local server access to the origin.  User cannot judge whether the origin is evil or not.
10:49:23 <kaorumaeda> ... Candidate solution: ".local" server certs allowed only on user+UA grants.
10:50:19 <kaz> present+ Natashi_Rooney(GSMA), Vivien_Lacourba(W3C), Osamu_Nakamura(W3C), Adam_Roach(Mozilla), Koichi_Takagi(KDDI), J.C._Jones(Mozilla), Rik_Cabanier(Adobe), Mark_Foltz(Google), Hyojin_Song(LGE), Kenichi_Nunokawa(Keio), Satoshi_Nishimura(NHK)
10:50:38 <kaorumaeda> ... UA provides a new API that allows secure origin to access local devices by issuing .local server certificates.
10:51:38 <kaorumaeda> ... IoT devices' CSR with attestation key is sent to CA via UA's API.
10:52:14 <kaorumaeda> q?
10:54:29 <kaorumaeda> ... PoC impl on Web Bluetooth API. BLE can be a promising proximity transport. But we lack certs installation API.
10:55:12 <kaorumaeda> ... Does ".local server certificates" sound practical?
10:55:42 <kaz> present+ Anne_van_Kesteren(Mozilla), James_Graham(Mozilla)
10:55:47 <kaz> rrsagent, draft minutes
10:55:47 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/21-https-local-minutes.html kaz
10:56:07 <kaorumaeda> Anne: Focus with user consent is good. Tap on the device could approve establishing secure connections.
10:56:43 <kaz> present+ Wonsuk_Lee(ETRI)
10:56:46 <kaz> rrsagent, draft minutes
10:56:46 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/21-https-local-minutes.html kaz
10:57:14 <kaorumaeda> mkwst: Host name + hash of public key might be one way to achieve this.
10:57:29 <kazho> kazho has joined #https-local
10:58:45 <kaorumaeda> Cullen: If we assume dynamic DNS, nothing stops that the device decides it's unique host name.
10:59:28 <kaorumaeda> Anne: Local IP address disclosure is different between these solutions.
11:01:33 <kaorumaeda> Tatsuya: Randomized DNS name could be a similar approach in IPv6 local link address.
11:01:56 <gmandyam> q+
11:02:06 <kaorumaeda> ... When mDNS cannot be trusted, HTTPS neither.  There is no additional risk.
11:03:14 <kaorumaeda> Joe: Privacy problem exists in Mitsubishi cars' identities that can be tracked location
11:03:32 <kaorumaeda> Tatsuya: Domain name can be rotated.
11:03:53 <kaorumaeda> Cullen: Hardest part is to decide what privacy properties you want to protect.
11:04:17 <tidoust2> tidoust2 has joined #https-local
11:06:07 <kaorumaeda> @@@: ???
11:06:20 <kaz> s/@@@:/Giri:/
11:07:44 <kaorumaeda> Tomoyuki: Next steps: continue discussions but where?
11:08:19 <kaz> kaz: please continue the discussion about how to proceed :)
11:08:29 <kaz> [ adjourned ]
11:08:34 <kaz> rrsagent, draft minutes
11:08:34 <RRSAgent> I have made the request to generate http://www.w3.org/2016/09/21-https-local-minutes.html kaz
11:18:01 <kotakagi> kotakagi has joined #https-local
11:27:38 <kaz> kaz has joined #https-local
11:45:33 <mfoltzgoogle> mfoltzgoogle has joined #https-local
11:54:22 <Hiroki> Hiroki has joined #https-local
12:01:38 <satoshin> satoshin has joined #https-local
12:06:50 <kaorumaeda> kaorumaeda has joined #https-local
12:08:56 <Karima> Karima has joined #https-local
12:12:05 <tidoust> tidoust has joined #https-local
12:12:40 <Hiroki> Hiroki has joined #https-local
12:13:31 <vivien> vivien has left #https-local
12:14:12 <Tomoyuki> Tomoyuki has joined #https-local
12:21:13 <tidoust> tidoust has left #https-local
12:37:17 <Hiroki> Hiroki has left #https-local
12:40:41 <Hiroki> Hiroki has joined #https-local
12:40:47 <Hiroki> Hiroki has left #https-local
12:58:07 <Tomoyuki> Tomoyuki has joined #https-local
13:02:23 <kaorumaeda> kaorumaeda has joined #https-local
13:04:41 <Karima> Karima has joined #https-local
13:07:02 <takeshi> takeshi has joined #https-local
13:07:16 <takeshi> takeshi has left #https-local
13:09:50 <Tomoyuki> Tomoyuki has left #https-local
13:10:08 <Zakim> Zakim has left #https-local
13:39:04 <MikeSmith> MikeSmith has left #https-local
14:29:08 <Karima> Karima has joined #https-local
14:31:11 <kaorumaeda> kaorumaeda has joined #https-local
14:32:17 <satoshin> satoshin has joined #https-local
14:33:01 <satoshin> satoshin has left #https-local
14:33:46 <kotakagi> kotakagi has joined #https-local
14:38:51 <Karima> Karima has joined #https-local
14:45:19 <Karima> Karima has joined #https-local
14:50:16 <mfoltzgoogle> mfoltzgoogle has joined #https-local
14:58:04 <Karima> Karima has joined #https-local
15:37:32 <kotakagi> kotakagi has joined #https-local
15:38:13 <kaorumaeda> kaorumaeda has joined #https-local
15:41:26 <Karima> Karima has joined #https-local
15:48:37 <Karima> Karima has joined #https-local
16:08:15 <Karima> Karima has joined #https-local
17:22:26 <Karima> Karima has joined #https-local
17:53:01 <kotakagi> kotakagi has joined #https-local
20:37:20 <Karima> Karima has joined #https-local
21:58:09 <kaorumaeda> kaorumaeda has joined #https-local
22:28:34 <kaorumaeda> kaorumaeda has joined #https-local
22:35:28 <kaorumaeda_> kaorumaeda_ has joined #https-local