21:05:06 <RRSAgent> RRSAgent has joined #websec
21:05:06 <RRSAgent> logging to http://www.w3.org/2014/10/27-websec-irc
21:05:17 <fjh> fjh has joined #websec
21:05:31 <hadleybeeman> hadleybeeman has joined #websec
21:05:33 <tanvi> tanvi has joined #websec
21:05:37 <wseltzer> Virginie: Co-chair of Web Security Interest Group
21:05:41 <fjh> fjh has joined #websec
21:05:42 <ckerschb> ckerschb has joined #websec
21:05:45 <wseltzer> wseltzer has changed the topic to: Web Security IG at TPAC
21:05:51 <wei_james_> wei_james_ has joined #websec
21:05:51 <deian> deian has joined #websec
21:05:52 <puhley> puhley has joined #websec
21:05:52 <fjh> fjh has joined #websec
21:05:53 <Kevin_Hill_> Kevin_Hill_ has joined #websec
21:05:58 <JeffH_> JeffH_ has joined #websec
21:06:05 <brutzman_> brutzman_ has joined #websec
21:06:24 <christine> christine has joined #websec
21:06:26 <jin> jin has joined #websec
21:06:30 <wseltzer> Topic: Introductions
21:07:05 <karen_od> karen_od has joined #websec
21:07:15 <Dan_> Dan_ has joined #websec
21:07:33 <colin> colin has joined #websec
21:07:53 <rigo> rigo has joined #websec
21:08:14 <dveditz> dveditz has joined #websec
21:08:35 <bhill2> bhill2 has joined #websec
21:09:22 <wseltzer> Virginie: Thanks for joining us
21:09:32 <wseltzer> ... I had some slides, then the projector power died
21:09:51 <wseltzer> ... We revived the WebSec IG last year
21:10:02 <wseltzer> ... in response to security requests coming from W3C WGs
21:10:22 <wseltzer> ... Mission is to discuss security topics; not to produce recs.
21:10:52 <wseltzer> ... Build a community, discuss topics of interest, take actions.
21:10:57 <virginie> virginie has joined #websec
21:11:00 <virginie> https://www.w3.org/Security/wiki/IG
21:11:20 <melinda> melinda has joined #websec
21:11:46 <DWalp> DWalp has joined #WebSec
21:11:56 <wseltzer> ... Requested to do security reviews, evaluate mobile security
21:12:11 <wseltzer> rrsagent, make logs public
21:12:16 <wseltzer> rrsagent, make minutes
21:12:16 <RRSAgent> I have made the request to generate http://www.w3.org/2014/10/27-websec-minutes.html wseltzer
21:12:28 <virginie> http://www.w3.org/Security/wiki/IG/W3C_security_roadmap
21:12:47 <wseltzer> ... understand security model, build roadmap
21:12:51 <keiji_> keiji_ has joined #websec
21:12:55 <wseltzer> Chair: Virginie_Galindo
21:13:09 <wseltzer> Meeting: Web Security Interest Group informal meeting
21:13:36 <wseltzer> Virginie: High expectations, but less ability to deliverable
21:14:11 <wseltzer> Virginie: [noting points from http://www.w3.org/Security/wiki/IG/W3C_security_roadmap ]
21:15:04 <Dan_> Dan_ has joined #websec
21:15:31 <wseltzer> ... Information-sharing
21:15:51 <wseltzer> ... September was workshop season
21:16:02 <wseltzer> ... Permissions, WebCrypto vNext
21:16:22 <rigo> There is still Workshop season: http://www.w3.org/2014/privacyws/
21:16:52 <virginie> FYI : permission workshop report is here : http://www.w3.org/2014/07/permissions/
21:16:54 <hadleybeeman> wseltzer: It was not a formal workshop, more a meeting of the sysops working group — talking about ways to standardise asking for/granting/scoping permissions.
21:17:06 <hadleybeeman> ... Dave Raggett is planning to recap that in a session on Wednesday.
21:17:35 <hadleybeeman> ... For capabilities that go beyond the normal in a browser, where a user might want to control whether the web app has access to sensors or data in a secure storage —
21:17:58 <hadleybeeman> ...— it should be able to ask the user for permission.  One time?  Hybrid?  How does the permission persist?
21:18:23 <hadleybeeman> ... Do we now have enough experience across capabilities and across browsers and devices to form some best practice/standard?  And if so, who should do it?
21:19:00 <hadleybeeman> ...It will at least partly be here in Security because the user might be tricked into doing something the don't want, or the web app might not get the capabilities it needs if it doesn't ask accurately
21:19:17 <hadleybeeman> ...How do we balance usability, functionality, performance etc?
21:19:56 <fjh> W3C Workshop on Privacy and User–Centric Controls
21:20:22 <wseltzer> -> http://www.w3.org/wiki/TPAC2014/SessionIdeas#Trust_and_Permissions_in_the_Open_Web_Platform DSR's session proposal for Wednesday's unconference: Trust and Permissions
21:21:36 <fjh> http://www.w3.org/2014/privacyws/
21:22:10 <fjh> workshop with deadline for position papers Friday, please let me know if interested
21:22:28 <fjh> 20-21 Nov, Berlin
21:23:00 <wseltzer> Rigo: Stemming from work of DT and Mozilla on understandable user controls
21:23:09 <virginie> q?
21:23:22 <wseltzer> ... I presented research in Pisa: we need to care more about UI
21:24:08 <wseltzer> Virginie: WebCrypto vNext workshop
21:24:10 <wseltzer> http://www.w3.org/2012/webcrypto/webcrypto-next-workshop/
21:24:22 <wseltzer> ... What comes after WebCrypto gives crypto primitives to web developers
21:24:52 <wseltzer> ... Discussed authentication challenges, secure tokens, trusted execution environments, secure tokens -- how to use them on the Web
21:25:01 <wseltzer> ... input to rechartering of WebCrypto WG
21:25:06 <wseltzer> http://www.w3.org/2012/webcrypto/webcrypto-next-workshop/report.html
21:25:23 <wseltzer> virginie: There's lots of interest in Security
21:25:29 <wseltzer> ... 70 people at webcrypto workshop
21:25:46 <fjh> q+
21:25:50 <wseltzer> ... so, how do we transform ideas into deliverables?
21:25:57 <QIJINGWANG> QIJINGWANG has joined #websec
21:25:58 <wseltzer> ack fjh
21:26:13 <wseltzer> fjh: Focus and prioritization
21:26:24 <wseltzer> ... where should it lie?
21:26:54 <wseltzer> ... Is key management, hardware crypto, environment?
21:27:21 <wseltzer> virginie: WebCrypto WG, after publication of v1, will work on new algorithms
21:27:25 <hadleybeeman> q+ to ask about use cases
21:27:27 <wseltzer> ... hw tokens, certificate management
21:27:35 <Zakim> Zakim has joined #websec
21:27:43 <wseltzer> ... hardware-protected or strong software-protected keys
21:27:43 <hadleybeeman> q+ to ask about use cases
21:28:07 <wseltzer> ... Web Security IG hasn't been able to set priorities, because we're looking for contributors
21:28:25 <wseltzer> ... We're trying to do reviews, but not finding volunteers
21:28:44 <fjh> q?
21:28:53 <virginie> http://www.w3.org/Security/wiki/IG/W3C_spec_review
21:30:00 <virginie> q?
21:30:01 <rigo> q+
21:30:02 <wseltzer> ack hadleybeeman
21:30:02 <Zakim> hadleybeeman, you wanted to ask about use cases
21:30:26 <wseltzer> hadleybeeman: Wiki has a list of topics. Does the IG have a set of use cases?
21:30:48 <wseltzer> virginie: We're trying to build a ccommunity of people willing to take on cases
21:31:00 <rigo> ack rigo
21:31:02 <wseltzer> ack next
21:31:26 <wseltzer> rigo: STREWS has written 120 pages
21:31:26 <virginie> q?
21:31:54 <rigo> s/120 pages/a WebRTC security report/
21:33:06 <fjh> q+
21:33:32 <wseltzer> virginie: What shoudl the IG do?
21:33:50 <wseltzer> fjh: Focus could help
21:33:55 <fjh> q-
21:34:11 <wseltzer> q+
21:34:27 <christine> q+
21:34:45 <wseltzer> q- later
21:35:16 <wseltzer> Virginie: what are you in the room interested in doing?
21:35:33 <wseltzer> christine: Some thoughts from the Privacy Interest Group's experience (PING)
21:35:47 <wseltzer> ... e.g. develop guidance that can readily be used by other groups
21:35:53 <weijames> weijames has joined #websec
21:36:05 <wseltzer> ... one group can't review everything
21:36:21 <bhill2> is there anyone on irc who was dialed-in to 92794# Zakim and wants us to re-start the bridge?
21:36:24 <JeffH_> one small group
21:36:40 <virginie> q+ to discuss security consideration in specification
21:36:43 <wseltzer> ... one thing we've found helpful is to have iterative discussions with chairs or WG members of groups seeking guidance
21:36:53 <wseltzer> ... PING meets Friday, join us
21:36:56 <wseltzer> ack christine
21:37:20 <wseltzer> ... Guidance: Fingerprinting, privavcy considerations for web protocls, spa: spec privacy assessment
21:38:22 <wseltzer> ... Do we do security guidance at the same time as privacy? togehter?
21:38:43 <npdoty> npdoty has joined #websec
21:38:54 <wseltzer> virginie: we started an effort to write security consdieration guidance
21:39:17 <virginie> q-
21:39:20 <christine> q+
21:40:03 <hadleybeeman> wseltzer: As technology and society domain lead now in W3C, we keep hearing from the public that Web Security is important.  We need to improve it.  But we need your help in focusing how we do that.
21:40:04 <karen_od> +q
21:40:23 <virginie> FYI : begining of a draft of a try of guideline for security recommandation section https://www.w3.org/Security/wiki/IG/W3C_spec_review/Security_Guidelines
21:40:26 <hadleybeeman> ...We know this is an ecosystem problem.  We think W3C is a good point to bring people together to solve web security, improve it.
21:40:48 <hadleybeeman> ...Should we put calls out to volunteers? Or do we need a more focused effort?  A group that looks more like the TAG?
21:40:55 <christine> q-
21:41:13 <hadleybeeman> ...Do we need you to ask your AC reps to ask W3C to prioritise this, put more resources onto it?  Or less effort onto it?
21:41:24 <virginie> q?
21:41:48 <bhill2> q+
21:41:51 <hadleybeeman> q+ to advocate a working group — with a lot of dependenices
21:42:08 <wseltzer> Kevin_Hill: 1st call to action could be to develop the focus, MS has someone who would help
21:42:09 <virginie> ack wseltzer
21:42:16 <nvdbleek> nvdbleek has joined #websec
21:42:35 <Dan_> Dan_ has joined #websec
21:42:35 <wseltzer> karen_od: TAG has started discussions. What's happened there?
21:43:23 <wseltzer> virginie: some people think TAG + editors is enough to do security review; others think there needs to be an external review
21:44:28 <rigo> q+
21:44:32 <wseltzer> ack karen_od
21:44:43 <wseltzer> ack bhill
21:44:56 <wseltzer> bhill: a TAG or Security TAG sounds like a good idea
21:45:35 <wseltzer> ... a more formal organization, visibility, prestige, can give people accountability
21:45:45 <wseltzer> ack hadleybeeman
21:45:45 <Zakim> hadleybeeman, you wanted to advocate a working group — with a lot of dependenices
21:46:10 <wseltzer> hadleybeeman: I'd like us to focus on the things we can build
21:46:14 <wseltzer> q+
21:46:18 <rigo> q- later
21:46:24 <wseltzer> ... that's why I'd say a WG
21:46:41 <wseltzer> ... we could easily talk for 10 years, without making something concrete
21:46:43 <rigo> scribenick: rigo
21:46:46 <brutzman_> q+
21:46:51 <hadleybeeman> ack wselt
21:47:25 <rigo> wseltzer: we are trying to get some focus and not just talking. WebAppSec is doing a lot of concrete specs for web application
21:47:29 <hadleybeeman> wseltzer: That is where we're trying to get some focus, rather than just talking.  We have Web Apps Sec WG producing concrete specs.
21:47:43 <rigo> scribenick: hadleybeeman
21:47:54 <hadleybeeman> ...Are there other pieces to add to this road map?  Can we see other places where the road is insecure?
21:48:06 <virginie> q?
21:48:16 <rigo> ack brutzman_
21:48:20 <hadleybeeman> scribenick: wseltzer
21:48:37 <wseltzer> brutzman_: EXI has some specific concerns
21:48:46 <terri> q+
21:49:01 <wseltzer> ... just posted to the mailing list, security considerations around canonicalization
21:49:04 <wseltzer> ... and digital signatures
21:49:18 <wseltzer> ack rigo
21:49:48 <wseltzer> rigo: European research scene has multiple roadmapping projects
21:49:55 <wseltzer> ... 6-8 months out
21:50:08 <wseltzer> ... how about security of linked data?
21:50:11 <brutzman_> ... for Efficient XML Interchange (EXI) https://www.w3.org/XML/Group/EXI/
21:50:18 <wseltzer> ... we haven't talked about that at all
21:50:33 <virginie> q?
21:50:45 <wseltzer> ack terri
21:50:57 <wseltzer> terri: It's been very hard for me to get time allocated without a roadmap
21:51:03 <rigo> also we haven't talked about Linked data security at all so far. And this is a pressing need.
21:51:05 <wseltzer> ... because it seemed too unstructures
21:51:11 <virginie> q?
21:51:20 <wseltzer> ... we need more structure in order to get volunteers.
21:51:33 <JeffH_> oberves that W3C historically hasn't prioritized security -- eg not requiring Recommendations to have (well-crafted) security considerations sections -- also web sec experts per se don't seem to inhabit w3c working groups (in general, there's exceptions of course), plus there isn't a security-oriented community a la IETF SAAG folk -- and so also w/o top-down security emphasis such as that that occurred in the IETF in the mid-to-late 1990's (eg: every RFC SHA[CUT]
21:51:40 <fjh> fjh has joined #websec
21:52:20 <JeffH_> a sec cons section..."  -- also there's OWASP where web sec folk seem to hang out -- is there some way to cross-fertilize between W3C and OWASP?
21:52:32 <wseltzer> virginie: Takeaways, let's focus, work with PING
21:52:47 <wseltzer> ... test the idea of a security TAG
21:53:05 <christine> q+
21:53:11 <wseltzer> terri: had some conversations with OWASP
21:53:23 <wseltzer> bhill: there are lots of potential people who aren't W3C members
21:54:08 <wseltzer> ... consultancies see they're already volunteering their people's time, why also pay membership?
21:54:19 <wseltzer> ... other ways to interact?
21:54:44 <wseltzer> ack christine
21:55:12 <wseltzer> christine: PING hopes to have a breakout Wednesday on privacy considerations for web protocols
21:55:22 <virginie> q?
21:55:23 <wseltzer> ... participate, because there are overlaps between privacy and security
21:55:37 <wseltzer> ... and PING is also meeitng Friday
21:56:15 <wseltzer> virginie: Thanks WebAppSec for sharing your room
21:56:16 <christine> starting early - 8:30 am
21:56:22 <wseltzer> ... We'll schedule another call soon
21:56:31 <virginie> thanks !
21:56:49 <melinda> melinda has joined #websec
21:58:21 <bhill2> bhill2 has left #websec
22:10:22 <ckerschb> ckerschb has left #websec
22:15:37 <Siva> Siva has joined #websec
22:16:27 <Siva> Joining late...is the discussion still alive?
22:17:42 <tanvi> tanvi has joined #websec
22:22:48 <JeffH_> test
22:26:29 <jin> jin has joined #websec
22:34:28 <puhley> puhley has left #websec
23:09:06 <wseltzer> rrsagent, draft minutes
23:09:06 <RRSAgent> I have made the request to generate http://www.w3.org/2014/10/27-websec-minutes.html wseltzer
23:09:14 <fjh> fjh has joined #websec
23:09:31 <wseltzer> siva, WebSec discussion finished. Draft minutes ^
23:10:27 <wseltzer> i/Virginie: Co-chair of Web Security Interest Group/scribenick: wseltzer
23:10:34 <wseltzer> s/siva, WebSec discussion finished. Draft minutes ^//
23:10:47 <wseltzer> rrsagent, draft minutes
23:10:47 <RRSAgent> I have made the request to generate http://www.w3.org/2014/10/27-websec-minutes.html wseltzer
23:41:45 <npdoty> npdoty has joined #websec
23:56:58 <hadleybeeman> hadleybeeman has left #websec