W3C

– DRAFT –
Web Authentication WG

05 May 2021

Attendees

Present
dveditz, jfontana, wseltzer
Regrets
-
Chair
-
Scribe
jfontana

Meeting minutes

tony: TPAC. Group meeting. We can do that. Virtual

https://github.com/w3c/webauthn/pull/1609

elundberg: likely a typo

tony: merge

https://github.com/w3c/webauthn/pull/1607

elundberg: editorial. fix date.

https://github.com/w3c/webauthn/pull/1600

akshay: looks fine.

tony: merge

https://github.com/w3c/webauthn/pull/1599

tony: any issues.

https://github.com/w3c/webauthn/pull/1586

agl: do 1585 first

https://github.com/w3c/webauthn/pull/1585

jeffH: merged

https://github.com/w3c/webauthn/pull/1586

jeffH: merged.

https://github.com/w3c/webauthn/pull/1576

jeffH: may want to mark as draft. this will be on-going discusson

dtony: mark it as draft.

https://github.com/w3c/webauthn/pull/1425

jeffH: this is another on-going discussion

elundberg: next step may be more reviews.
… should see how it interacts with #1546, depends on how it is addressed
… might become a special case. need to consider this
… figure out #1546 and then go on to next one. #1425

tony: issues to look at.

https://github.com/w3c/webauthn/issues/1608

akshay: looks like they want web authn for all crypto

lundberg: have external apps and add signatures.

jbradley: we have a tension around privacy
… audience restricted to origin.
… don't know origin of blockchain
… how would we do this with a FIDO assertion?
… these are legit use cases, but open can of worms and not being thought through
… we can stop this in the browser
… managing certificates is hard. not sure we want to go there
… why invent something new, if there is something else we can use.

agl: we have no intent to expand past authentication use cases

jbradley: should be hardware backed for web crypto.
… ??

agl: I don't think web authn will be the way we expose native apps
… this issue is too ambitious. aa full-feature to talk to native apps is not web authn territory.

dwaite: could be privacy implications

jbradley: we need to understand the web cyrpto intent

jbradley: sounds like not huge move to expand web authn
… if folks want web crypto, maybe that is worked on somewhere else

akshay: this is authtication.
… UV is another issue, do people care about that.

wendy: this group has avoided some issues by the carefully scoped work.

<jeffh> see also: https://github.com/w3c/webauthn/issues/1595#issuecomment-816970977 for links to Hardware-backed Security Services Community Group, whose unfinished draft report takes a stab at a WebCrypto-linked Secure Credential Storage API.

DanV: focus on this group has been helpful. Just because we talk to hardware doesn't mean everyone should get access.
… Web Authn is not a general anything.

agl: a statemen will be helpful

agl: not here, not , not ever

tony: you will write statement and close?

jeffH: yes

https://github.com/w3c/webauthn/issues/1603

elundberg: this is a duplicate, we should close

tony: yes.

https://github.com/w3c/webauthn/issues/1680

correction: https://github.com/w3c/webauthn/issues/1608

https://github.com/w3c/webauthn/issues/1601

jeffH: invites RP to select UV modality

aakshay: close

tony: close

https://github.com/w3c/webauthn/issues/1580

agl: should close

jbradley: I will close

tony: adjourn

Minutes manually created (not a transcript), formatted by scribe.perl version 131 (Sat Apr 24 15:23:43 2021 UTC).

Diagnostics

Succeeded: s/user/RP/

No scribenick or scribe found. Guessed: jfontana

Maybe present: aakshay, agl, akshay, correction, DanV, dtony, dwaite, elundberg, jbradley, jeffH, lundberg, tony, wendy