One Web for Everyone

"The social value of the Web is that it enables human communication, commerce, and opportunities to share knowledge. One of W3C's primary goals is to make these benefits available to all people, whatever their hardware, software, network infrastructure, native language, culture, geographical location, or physical or mental ability."

Sir Tim Berners-Lee, W3C Director and Inventor of the World Wide Web.

Open Standards: Big Picture

Not just a technical problem.

Open Standards Policies

• No-one should require people to purchase particular software for access
• Promote longevity of information
• Openness helps to maximize reuse of knowledge
  • colleagues, friends, public, companies, governments

• Open standards promote research
• Open standards have brought us the Internet and the Web
• Commercial Interest:

Open Standard Definition

A lot of debates nowadays for a common definition of Open Standards.

W3C recently endorsed with fellow SDOs IEEE and IETF the Open Stand definition, aka The Modern Paradigm for Standards:

1. Cooperation among all stakeholders
2. Standardization with Due process, Broad consensus, Transparency, Balance and Openness.
3. Collective Empowerment based on technical merit, on providing global interoperability, scalability, stability, and resiliency, and on enabling global competition, further innovation, the creation of global communities, thus benefiting humanity.
4. Availability of technology with reasonnable IPR
5. Voluntary Adoption

Challenges...

• The Internet and the Web is the easy part : Web, email, forum, online chat, IM, etc.
• Lots of non-internet technologies: telephone, fax, PDA, SMS, MMS, RFID, biometric, smart cards, TV and radio, etc.
• New technology-specific challenges: geolocation, social, privacy, ads, etc.

"If we can produce everything I can imagine, we will have failed. The idea is to produce everything other people can imagine". TBL.

W3C Exec Summary

The World Wide Web Consortium (W3C) is an International Consortium where Member and External organizations, a full-time technical staff, and the public work together to lead the World Wide Web to its full potential by developing Web standards such as protocols and guidelines that ensure long-term growth for the Web.

• Goals: Interoperability, Universality, Functionalities
• Neutral/nonforprofit, consensus based, open participation, open results
• Legal nature: a joint partnership between several academic institutions, funded by the private sector and some public grants.

  4 Host sites: Massachusetts Institute of Technology (Boston, Massachusetts, USA), the European Research Consortium in Informatics and Mathematics (Sophia-Antipolis, France) and Keio University (Shonan Fujisawa, Japan). New in 2013: a W3C host in China, at Beijang University.

• A small staff and a large community of experts.
• Hundreth of Members from all horizons. Thousands of Invited Experts from even more regions and countries.
• A network of W3C Offices around the world.

W3C Process Flow

Based on a transparent and public Process compatible with WTO standard guidelines.

Web Standards

What most people talk about:

Accountable to the Global Public

• W3C is accountable to Members and to non-Members around the globe.
• All Working Groups maintain public Web sites and mailing lists.
• All draft standards documents available to the public at a very early stage.
• Public-participation Interest Groups for worldwide collaboration and community building via open email lists.
• A growing network of volunteers translators working on W3C standards and reports and press releases into multiple languages.

Global Standards as enablers

Substantive work in areas with the particular objective of enabling Universal Access to the Web.

• The Web Accessibility Initiative develops technology, guidelines, and tools to increase accessibility of the Web for people with disabilities.
• The Internationalization Activity makes it possible and easy to use W3C technology worldwide by breaking down barriers between the Web and our planet's many languages, scripts, and cultures.
• W3C's Mobile Web Initiative aims to make Web access from a mobile device as simple and convenient as Web access from a desktop device, critical for the developing world.

Removing economical barriers

• W3C's industry-leading Patent Policy promotes the creation of Web standards that can be implemented on a Royalty-Free basis.
• This policy allows the rapid development by Open Source community and Commercial ventures, from high income to low income regions alike, by removing financial barriers to the implementation of our Standards.
• Since 2005, W3C runs a unique program to substantially reduce Membership fees by 40 to 85% for small companies and not-for-profit organizations based in the developing world.
• See also our Mobile Web in Developing Countries and the Web Foundation work.

International Relations and Liaisons

• The Consortium maintain liaisons with over 50 national, international and regional organizations around the globe
• IETF, ISO, IEEE, ITU, OMA, OMG, OASIS, OpenGIS, ICANN, Unicode, UN, IGF and many others.
• Our goals:
  • Improved Mutual Understanding of Web technologies
  • Better Web Standards.
  • More Widely Used Web Standards.

Early work on Web Payments

• 1996 - JEPI - payment negotiation
  • Enabling web browsers and servers to search for compatible payment solutions
• 1999 - Common Markup for micropayment per-fee-links
• Micro Payments
  • IBM micropayments, iPIN, Millicent, NetBill
• Web Advertising emerges as dominant model
• Proprietary solutions for payments
  • Ease of phishing as a threat to card payments

"Improved" security for card payments: 3DSecure

• Branded as Verified by VISA and MasterCard SecureCode
• User authentication and confirmation of payment in HTML IFRAME
• Users still have to enter card details and a password, facilitating phishing
• Shifting liability onto the card holder through legal loophole!

"Verified by Visa and MasterCard SecureCode: or, How Not to Design Authentication", Steven J. Murdoch and Ross Anderson, Financial Security and Cryptography, January 2010.‎

Second factor approaches

• Using the customer's phone as a separate communications channel
  • User keys one time numeric code into phone as shown in IFRAME
  • Or visa versa using code sent to user's cell phone via SMS
• Using a proprietary device, e.g. Chip Authentication Program (CAP)
  • Handheld device issued by bank with display, keypad and card slot
  • User inserts card for one of several supported authentication protocols
• Finger swipe or PIN entry in conjunction with Secure Element
  • Secure element with compute and storage resources, e.g. SIM or microSD
  • Secure element generates proof of user's presence following local authentication of user

Need to separate identity and authentication - lack of global standards

An increasing variety of payment solutions

• PayPal, Stripe, allpay, Tenpay, Square, Verifone SAIL, Flint, V.me, Paypass, Weve, Isis, MasterPass, Google Wallet, LevelUp, GSMA OneAPI, Mozilla mozpay API, Facebook Payments, MintChip, Bitcoin, Paymium Paytunia, Amazon Coins, CentUp, Flattr, PaySwarm, WebCredits, IFEX, Ripple, ...
• More info on these

The huge variety causes pain for users and developers alike!

Current W3C Initiatives

• W3C Team led task force on Web payments
  • http://www.w3.org/wiki/Payments_Task_Force
• Web Payment Community Group
  • Discussion forum aiming at realizing Universal Payment for the Web
  • http://www.w3.org/community/webpayments/
• W3C Workshop planned for early 2014
  • Paris, March? Date to be finalized soon

Emerging themes

• Focus on improving usability and security
• Digital wallets that hold multiple payment solutions as well as loyalty coupons etc.
• Mix of device embedded and cloud based technologies
• Users want to access their wallet from any of their personal devices!
• Reducing the effort expected from web developers whilst give users control over how they pay

Workshop Positioning

• Is it timely to initiate work on Web payment APIs?
• Start with simple payment request API
  • Browser hands over request to wallet for user to choose how to pay
  • Users may be asked to to authenticate themselves and confirm payment
  • Selected payment provider generates proof of payment for merchant
  • Wallet and payment providers as examples of trusted system apps
• Later expand scope to offline and person to person payments
• Ensuring a level playing field for payment providers, existing and new, large and small!
• Need to be able to install new payment providers after device has shipped

Relevant existing and new standards activities

This is just a few of the relevant examples

• W3C System Applications Working Group
  • Trusted system apps as alternative to native apps
  • API for access to Secure Elements
  • API for access to Bluetooth
• W3C NFC Working Group
• W3C WebCrypto Working Group
• Interest in location based value-added services
  • Outdoors, and soon indoors ...
  • Bluetooth Low Energy: PayPal Beacon, Apple iBeacon

Conclusion

• W3C: A unique combination of characteristics among Standard organizations.
• Open standards are the future for payments, just as for the Web
  • Open standards power the ecosystem creating more opportunities for innovation
  • Open standards provide sustainable revenues for stakeholders
• EPASOrg can leverage the experience gained by W3C
• Greater Opportunities for Everyone!

"Tim, why did you choose www for the Web in 1989 ?"

"I googled it and it wasn't taken"