15:29:11 RRSAgent has joined #wpwg 15:29:11 logging to http://www.w3.org/2017/05/02-wpwg-irc 15:29:15 Zakim has joined #wpwg 15:29:19 Meeting: Tokenization Task Force 15:29:23 Chair: Roy 15:29:26 Scribe: Ian 15:31:04 present+ 15:31:07 present+ Christian 15:31:09 present+ Olivier 15:31:34 present+ Stan 15:33:37 present+ Roy 15:34:00 regrets+ AdrianHB 15:35:39 Topic: The project 15:35:49 mweksler has joined #wpwg 15:35:50 Roy: What do we need to do to get the spec to a place where it is supported? 15:36:05 oyiptong: We did get some feedback in Chicago 15:36:22 ...next steps included the possibility of multiple payment method specs 15:36:25 q+ 15:36:38 present+ Sachin 15:36:43 present+ Manash 15:37:31 Roy has joined #wpwg 15:37:37 SachinAhuja has joined #wpwg 15:37:38 Manash has joined #WPWG 15:38:03 https://www.w3.org/2017/03/24-wpwg-minutes#item03 15:38:40 IJ: what problems do we want to solve? 15:39:49 Roy: My rendition of "what problem we want to solve": basic card is a bootstrapping mechanism. Where we want to go as an industry is toward tokenization 15:40:03 q+ 15:40:05 ...so the purpose of the spec is to make it easier to do tokenized (card) payments 15:40:06 ack me 15:40:12 ack oy 15:40:45 oyiptong: If I may, I know you just mentioned that gateway tokens might be too proprietary ... I would like for us to consider also creating a gateway token spec 15:40:46 q? 15:41:09 q+ 15:41:19 roy: It's not that we don't think it's valuable, but we think that the inputs/outputs are so different, we weren't sure how to produce a payment method spec 15:41:20 ack man 15:41:48 manash: MC joined W3C the week before last. Sachin and I will be representing MC in the task force and we're happy to be here. 15:42:16 ..MC (as well as Visa, Amex) have been promoting tokenization in the market for some time. EMVCo's standard has been adopted by issuer banks, acquirers, merchants, and gateways 15:42:51 ..there are different types of tokenization...there is card on file but also card on file on the merchant side 15:43:04 ..you can generate cryptograms through cloud-based methods 15:43:08 ..there are tokens on secure elements 15:43:12 ..there are tokens in the cloud 15:43:29 ...we should look at existing standards in the market 15:43:48 ...we think that tokens are more secure (than PAN) 15:43:52 ..and also liability shift is an important consideration 15:44:15 ....we should also understand what should motivate merchants when they adopt tokenization 15:44:24 q+ 15:44:27 ack oy 15:44:34 q+ oyipton 15:44:45 sachin: I need some clarity on the drivers on this 15:45:13 Roy: Spec had been focused on issuer/network tokens 15:45:20 Sachin: the conversation is around acceptance... 15:46:05 ...suppose stripe starts accepting network/issuer token...doesn't that solve e.g., the Airbnb use case and liability issue is covered? 15:46:07 oyiptong: Yes 15:46:27 Michel: I think issuer tokens would work, they would require a different integration than the one we have today, which is not a small undertaking. 15:46:45 ..where olivier was going earlier was to try to create a standard that would more closely describe what many merchants have today 15:46:53 ..where they have someone like braintree or stripe they integrate with . 15:47:01 ...and those are gateway tokens 15:47:26 ...I think that there are many merchants that have integrations like that....they get a token that they use 15:47:47 ..I take roy's point that there's a lot of proprietary information, but I think that there's room to create a standard to make integration earier 15:47:57 Sachin: There is merit in that conversation. The construct is similar 15:48:07 ...there is definitely room for standardization. ...but 15:48:22 ..the merchant might need to recode their backened to the new standard 15:48:29 ..or there's a data arbitrage that does the conversion 15:49:07 oyiptong: Where is tokenization done? At issuer level or gateway level? 15:49:13 ..I think it doesn't matter as long as there is one standard 15:49:24 ..but I think we need to account for a transition period 15:49:42 stan has joined #wpwg 15:49:45 ...there will still be knowledge needed to generate the tokens 15:49:55 ..we could align ourselves with something that exists 15:50:52 Sachin: We are calling both these things "tokens"...but they are fundamentally different 15:51:03 ...PSP token is an identifier of data kept in the PSP's data store 15:51:21 ..the issuer token is a cryptogram that is associated with a single-use transaction that can also provide a liability shift 15:51:41 mweksler: Yes, they are different as described, but in their pattern of use they are not so different 15:51:51 ...e.g., the user provides a PAN and the merchant gets a token 15:52:03 ..they do have different characteristics 15:52:11 ...but the distinction for user or merchant is less clear 15:52:22 ..the way that the data is transmitted to the acquirer is very different 15:52:35 1) PSP token - the regular PAN is eventually transmitted 15:52:49 2) Gateway - Cryptogram is transmitted and PAN never leaves the vault. 15:53:14 Manash: there is also additional data that is communicated 15:53:29 ...the nature of tokens is different. 15:53:37 mweksler: What are the differences? 15:53:56 Sachin: It might help for us to have an overview session regarding network tokenization ... but before we do that: 15:54:16 ..in the case of a network token is what we are generating is a cryptogram that goes in a specific field in the message sent to the acquirer. 15:54:21 ..the funding PAN is never transmitted 15:54:53 ..so there are big differences in what data is transmitted. 15:55:46 Stan: I will take the voice of our users...I think of merchants and users speaking in terms of gateway tokens 15:55:56 ..if they are happy users of their gateways, they don't want to switch 15:56:05 ...at the end of the day, users/merchants really do want gateway tokens 15:56:26 ..if we only come up with a standard that excludes gateway tokens, we will end up with client-side javascript libraries 15:56:44 +1 15:56:49 q+ 15:56:50 ..even if the w3c standard is used under the hood, stripe, braintree, etc. would have to use their own APIs 15:56:57 ...in client-side libraries 15:57:03 ..that's one argument for including gateway tokens 15:57:26 sachin: I hear that ... want to understand a bit more 15:57:53 ...suppose you have a merchant who is not PCI compliant..they will continue to use gateway tokens...and any issuer tokenization needs to be handled, it will be handled by the gateway (e.g., behind the scenes) 15:58:13 mweksler: I think what's important to think about is from the user/merchant perspective..t.he fact that we are doing gateway or network does not look that different 15:58:17 ..the merchant "does not care" 15:58:29 ...of course the tokens are used differently and have different security properties 15:58:40 ...but if you look at what the user and merchant see using the standard, is that they have a similar experience 15:58:46 ...the user provides a PAN and out comes a token 15:58:54 q? 15:59:03 queue==oyiptong 15:59:19 mweksler: If the differences are big we might end up with 2 standards.... 15:59:26 Sachin: I think the diffs are fundamentally large 15:59:40 ..we can write down both types, or sequence diagrams to help 15:59:47 ack oyiptong 16:00:00 oyiptong: I want to add to michel / stan...i think there are current business needs met with gateway tokens 16:00:19 ..vaults are important for recurring payments 16:00:39 Sachin: Agreed. These are fundamentally different constructs 16:00:48 ..I think the w3c need my be more toward gateway tokens 16:00:56 ..and behind the scene activity may be different 16:01:22 Topic: Next meeting 16:01:25 9 May 16:02:25 Stan: I think the right spec should be a layering of network tokens and on top of that gateway tokens 16:02:45 Sachin: I will take 2 actions 16:02:50 q+ 16:02:51 1) Present network token spec as an example 16:03:02 2) Sequence diagrams for both network and gateway 16:03:05 ack oyiptong 16:03:21 stan has joined #wpwg 16:03:25 oyiptong: It seems like the network and gateway tokens are orthogonal and we could come up with an abstraction 16:04:02 IJ: Maybe we start thinking about things as layers 16:04:12 RRSAGENT, make minutes 16:04:12 I have made the request to generate http://www.w3.org/2017/05/02-wpwg-minutes.html Ian 16:07:20 RRSAgent, set logs public 16:39:34 hober has joined #wpwg 17:27:17 cweiss has joined #wpwg 17:50:23 rrsagent, bye 17:50:23 I see no action items