16:54:42 <RRSAgent> RRSAgent has joined #webauthn
16:54:42 <RRSAgent> logging to http://www.w3.org/2016/06/15-webauthn-irc
16:54:44 <trackbot> RRSAgent, make logs public
16:54:44 <Zakim> Zakim has joined #webauthn
16:54:46 <trackbot> Zakim, this will be
16:54:46 <Zakim> I don't understand 'this will be', trackbot
16:54:47 <trackbot> Meeting: Web Authentication Working Group Teleconference
16:54:47 <trackbot> Date: 15 June 2016
16:56:04 <wseltzer> present=
16:56:07 <wseltzer> zakim, clear agenda
16:56:07 <Zakim> agenda cleared
16:59:03 <wseltzer> present+
16:59:16 <gmandyam> gmandyam has joined #webauthn
16:59:26 <gmandyam> present+ gmandyam
17:00:29 <weiler> weiler has joined #webauthn
17:01:41 <wseltzer> present+ TonyNadalin
17:02:14 <wseltzer> present+ Hubert
17:02:49 <wseltzer> present+ JeffH
17:02:56 <alexei-goog> alexei-goog has joined #webauthn
17:02:57 <apowers> apowers has joined #webauthn
17:03:08 <wseltzer> present+ Ketan
17:03:26 <wseltzer> present+ alexei-goog, dirkbalfanz
17:03:33 <weiler> present+
17:03:50 <wseltzer> present+ Nitin
17:03:59 <dirkbalfanz> dirkbalfanz has joined #webauthn
17:04:07 <dirkbalfanz> prese nt
17:04:12 <dirkbalfanz> present+
17:04:13 <vgb> vgb has joined #webauthn
17:04:15 <vgb> present+
17:04:23 <alexei-goog> present+
17:04:57 <wseltzer> zakim, who is here?
17:04:57 <Zakim> Present: wseltzer, gmandyam, TonyNadalin, Hubert, JeffH, Ketan, alexei-goog, dirkbalfanz, weiler, Nitin, vgb
17:04:59 <Zakim> On IRC I see vgb, dirkbalfanz, apowers, alexei-goog, weiler, gmandyam, Zakim, RRSAgent, adrianba, trackbot, slightlyoff, mkwst, wseltzer
17:05:42 <wseltzer> present+ SamSrinivas
17:05:44 <Rolf> Rolf has joined #webauthn
17:05:59 <SamSrinivas> SamSrinivas has joined #webauthn
17:06:01 <wseltzer> present+ Rolf
17:06:04 <SamSrinivas> present+
17:06:06 <wseltzer> present+ apowers
17:06:27 <RobTrace> RobTrace has joined #Webauthn
17:06:38 <JeffH> JeffH has joined #webauthn
17:06:48 <JeffH> present+
17:08:32 <wseltzer> Topic: Extensions
17:08:36 <Hubert> Hubert has joined #webauthn
17:09:25 <Hubert> present+
17:09:26 <SamSrinivas> Vijay to lead through his drafts. Also Rolf's alternate. Giri specific proposal.
17:10:22 <SamSrinivas> Vijay speaking: Fixed some contradictions in the text re: extensions. Every extension has to have a client argument seems to be there. Vijay fixed up all pre-defined extensions to fit this spirit. S
17:10:33 <SamSrinivas> Surprisied how little text needed to be added.
17:10:42 <wseltzer> -> https://github.com/w3c/webauthn/pull/130/files vgb's pull request
17:10:48 <SamSrinivas> (vijay still speaking)
17:11:19 <SamSrinivas> Made explicit tht the client argument should be convered to authenticator argument, in many cases, it is a straight pass-thru.
17:11:57 <SamSrinivas> All the pre-defined extensions fit this pass-thru model, except for authenticator selection, and that's prety simple too.
17:14:44 <SamSrinivas> Giri re: trusted location -- isn't some processing required. Vijay: processing = just converting to CBOR
17:15:11 <SamSrinivas> That transform is possible for any extension, even opaque
17:15:57 <wseltzer> i/Topic: Extensions/scribenick: SamSrinivas
17:16:23 <wseltzer> [reviewing https://github.com/w3c/webauthn/pull/130/files ]
17:16:53 <SamSrinivas> Vijay walking through diffs.
17:17:29 <SamSrinivas> Line 1410: Clarifuing client takes client args, not 'authenticator args'. Latter term was not defined, is not defined better.
17:17:57 <SamSrinivas> Line 1420: word smithing
17:18:44 <SamSrinivas> Line 1435:  extension has to specify how to convert client arg to authetnicator arg -- majority of cases it is pass thorugh.
17:20:28 <SamSrinivas> tenet: The RP should know what happened with the extensons it requested.
17:22:40 <SamSrinivas> Extensions should add to client data in some way to indicate to the RP that the extension was honored/respected/processed.
17:25:09 <SamSrinivas> Shouldn't client be responsible to add to client data for every extension? Since it owns client data? (Sam and Hubert). Vijay says "ok either way". Decision, to change the text to make it client's responsibiliuty
17:25:38 <Hubert> Hubert has joined #webauthn
17:28:22 <SamSrinivas> Added standard way of passing "true" in CBOR. Takes same amount of byte space as numeral.
17:29:08 <SamSrinivas> Makes it easy for client to just transform "true" in API call to "true" over CBOR generically.
17:30:14 <SamSrinivas> Your client can pass through unknown extensions after CBOR-izing.
17:30:53 <SamSrinivas> Giri: Reconfirming: All extensions are prompted. Vijay: yes, actually was always in spec that the RP has to specify a client argument.
17:30:57 <JeffH> SamSrinivas: my understanding is that a bound authnr that is not being accessed via CTAP, can add to clientData -- this raises issue of whether CTAP is declared the only means to access authnrs or not....
17:34:48 <JeffH> q?
17:35:13 <SamSrinivas> Most extensions will be pass through but extensions can also specify fancy client processing in principle. Authentucator selection requirest his for example.
17:35:21 <SamSrinivas> (vijay said)
17:35:27 <JeffH> s/his/this/
17:36:03 <SamSrinivas> Sam says: any extension needing client processing si a high bar and I see it coming into the main spec rather than just being specified in  registry
17:36:21 <SamSrinivas> Giri: Authenticator selection maybe should not be extension?
17:36:31 <SamSrinivas> It should be in main API?
17:38:23 <SamSrinivas> Vijay summarizing all other changes near end of doc -- basically straightforward, kinds of things covered earlier (eg, specifying CBOR true etc)
17:41:27 <JeffH> ... i.e. see line 1474
17:47:46 <JeffH> q?
17:48:42 <vgb> SamSrinivas: one issue with requiring pass-through of extensions - who will respect user's privacy if RP and authenticator maker have different view of the user's privacy than the user would have?
17:49:41 <vgb> Rolf: Would be great if pre-defined extensions at least would be honored
17:50:51 <SamSrinivas> Jeeff: Are there privacy concenrs with predefined extensions? Shouldnt it be ok to implement?
17:51:16 <SamSrinivas> (in reply to tony asking) Should client need to understand privacy implicatons?
17:58:31 <alexei-goog> q+
18:06:00 <wseltzer> [group to continue on-list discussion of extensions]
18:06:15 <wseltzer> zakim, list attendees
18:06:15 <Zakim> As of this point the attendees have been wseltzer, gmandyam, TonyNadalin, Hubert, JeffH, Ketan, alexei-goog, dirkbalfanz, weiler, Nitin, vgb, SamSrinivas, Rolf, apowers
18:06:18 <wseltzer> rrsagent, make minutes
18:06:18 <RRSAgent> I have made the request to generate http://www.w3.org/2016/06/15-webauthn-minutes.html wseltzer
18:06:39 <wseltzer> rrsagent, make logs public
18:06:42 <wseltzer> Chair: TonyNadalin
18:06:45 <wseltzer> rrsagent, make minutes
18:06:45 <RRSAgent> I have made the request to generate http://www.w3.org/2016/06/15-webauthn-minutes.html wseltzer
18:08:59 <weiler> weiler has joined #webauthn
20:47:17 <Zakim> Zakim has left #webauthn