Web Payments Interest Group Teleconference

<scribe> Scribe: ian

=> https://lists.w3.org/Archives/Public/public-webpayments-ig/2017Apr/0005.html Agenda

New Chair Welcome - Dapeng (Max) Liu

dezell: Thanks to Erik Anderson!
... I'd like to welcome Max as the new co-chair
... lots of interesting ideas from Alibaba and happy to have Max on board and fresh ideas

Max: Hello everyone!
... I am very pleased to have this opportunity to work with David as co_Chair of this IG
... I hope we can come up with some interesting ideas that lead to useful standards

Virtual reality payments

[Max slides]

[Max will send them after the meeting]

[Slide one shows virtual reality shopping..]

[e.g., user can "try on clothes" in VR shop]

[e.g., user can browse physical store, and also get more information about product]

(Related to this: W3C workshop on virtual reality and the Web => https://www.w3.org/2016/06/vr-workshop/)

Max: We have a demo...involves some user authentication
... but current authentication is name/password
... in current VR experience, user input is not very convenient
... typically difficult while wearing VR goggles
... we have ideas for using biometrics for authentication
... such as retina scan or fingerprint
... so for example, if the user is browsing the Web on mobile browser and using VR, there needs to be access to sensors for this authentication
... Web brings cross-platform interop

{See also VR Workshop report => https://www.w3.org/2016/06/vr-workshop/report.html)

scribe: interop could help connect into SDKs

dezell: I have some security questions.
... what are the standardization opportunities you see for W3C?

(For biometrics and strong authentication on the Web, see => https://www.w3.org/TR/2016/WD-webauthn-20160902/)

Max: Fingerprint can be stored locally
... e.g., in secure element

or in TEE

scribe: for other biometric information, e.g., iris or facial recognition, the computation may have to happen server-side

dezell: You can also do 2-factor authentication
... e.g., if you are using mobile phone

Max: that already happens in existing products
... but not common in VR payments yet

Today for payments we have:

- Payment Request API

- Web Authentication

- Web NFC

- Web Bluetooth

- Web Crypto

IJ: What is missing that we need to be looking at?

Max: That's a question I need more time to study
... as first steps we can collect the information that you mentioned - what we have already; and then begun a gap analysis
... e.g., does PR API need to be enhanced with additional authentication bits?
... could be easier for developers if authentication is integrated
... but in any case we need to do more research to understand more completely what needs to be done

dezell: (Note on retail stores losing ground to digital)
... Is WebRTC relevant?

Max: WebRTC is useful for real-time. Might be useful for interactions with retailer
... and in the future that might involve digital shopping assistants / AI

dezell: Next steps?

Max: I don't have next steps yet
... other than looking at gaps
... I will be doing research and looking at related drafts
... WPIG could develop use cases
... VR payments show value of biometric auth...but there might be new requirements in a VR setting

.e.g., there might be protocol requirements between phone and VR headsets

scribe: although that may be beyond scope of w3C

Max: if anyone is interested, please contact me

<dezell> If I understand correctly, FIDO would be authentication. There is a separate issue of Authorization (i.e. an additional step).

[From the virtual reality workshop..ideas for next steps]

====

Proposed new work for the near term included:

advancing WebVR API currently in incubation to a Working Group,

gamepad extensions,

improving support for 360 media integration in HTML, including 360° media streaming

projecting the DOM into non-rectangular spaces,

VR mode for CSS media queries,

means to customize surroundings of the user while browsing the Web in VR (Skybox API),

standardization of APIs for speech recognition, media synchronization, WebAssembly, and detection of media capabilities.

===

\https://www.w3.org/community/webvr/

<dezell> Ian: there appears to be a lot of work that the WebVR community group is considering.

https://w3c.github.io/vr-workshop/papers.html

<dezell> Ian: I suggest that as part of the research reaching out to the CG.

IJ: Some resources to check out as you begin research

dezell: Any other suggestions from people on the call, especially whether the IG should take this up? I think it is interesting.

=> https://www.w3.org/Payments/IG/wiki/WebPaymentIGProcess

Ken: Thanks for bringing this forward, Max. I think this is interesting technology and think it may have tremendous impact on shopping experience.
... when we look at the pain points, they seem to be the same pain points we've identified with other applications or shopping experiences
... such as authentication, biometrics, security, capturing user information, secure transfer of data, ...
... I want to encourage the effort...what will be important will be what is unique to VR?

Max: +1

Next meeting

No meeting 24 April

Next meeting is 1 May