16:51:51 <RRSAgent> RRSAgent has joined #webauthn
16:51:51 <RRSAgent> logging to http://www.w3.org/2017/06/14-webauthn-irc
16:51:53 <trackbot> RRSAgent, make logs public
16:51:53 <Zakim> Zakim has joined #webauthn
16:51:55 <trackbot> Zakim, this will be
16:51:55 <Zakim> I don't understand 'this will be', trackbot
16:51:56 <trackbot> Meeting: Web Authentication Working Group Teleconference
16:51:57 <trackbot> Date: 14 June 2017
16:52:07 <weiler> regrets+ weiler
17:00:36 <apowers> apowers has joined #webauthn
17:01:10 <Rolf> Rolf has joined #webauthn
17:03:11 <battre> present+
17:03:40 <jeffh> jeffh has joined #webauthn
17:03:45 <gmandyam> gmandyam has joined #webauthn
17:04:15 <gmandyam> present+
17:04:44 <wseltzer> present+
17:05:05 <selfissued> selfissued has joined #webauthn
17:05:15 <Rolf> present+
17:05:17 <dirkbalfanz> dirkbalfanz has joined #webauthn
17:05:18 <wseltzer> zakim, who is here?
17:05:18 <Zakim> Present: battre, gmandyam, wseltzer, Rolf
17:05:19 <Zakim> On IRC I see dirkbalfanz, selfissued, gmandyam, jeffh, Rolf, apowers, Zakim, RRSAgent, weiler, battre, mkwst, slightlyoff, jyasskin, jochen___, adrianba, wseltzer, trackbot,
17:05:19 <Zakim> ... jcj_moz
17:05:48 <wseltzer> present+ nadalin
17:06:02 <wseltzer> present+ apowers
17:06:19 <wseltzer> present+ jeffh, jfontana
17:06:34 <selfissued> present+
17:06:48 <wseltzer> present+ dirk
17:07:33 <wseltzer> regrets+ angelo
17:09:18 <wseltzer> -> https://www.w3.org/2017/11/TPAC/Overview.html TPAC 2017
17:09:29 <wseltzer> nadalin: WebAuthn meets Thursday
17:10:35 <jeffh> regrets+ jyasskin
17:12:48 <wseltzer> Topic: 476 and 477
17:13:29 <wseltzer> nadalin: we acknowledged Qualcomm's objection and pushed them to v2
17:13:51 <wseltzer> ... I've worked with Sam on a re-charter to extend the group
17:14:06 <wseltzer> ... proposing that v2 of the spec looks at authenticator options
17:14:13 <wseltzer> ... that's L2WD
17:14:17 <wseltzer> q+
17:14:23 <wseltzer> q-
17:14:41 <wseltzer> gmandyam: need clarification whether these issues will be addressed prior to Rec
17:14:55 <wseltzer> nadalin: no, they'll be addressed in v2
17:15:12 <wseltzer> gmandyam: we should record an organization-by-organization consensus
17:15:22 <wseltzer> nadalin: the objections were recorded in last week's minutes
17:15:23 <wseltzer> q+
17:18:01 <wseltzer> selfissued: proposed consensus is that these issue are post-recommendation
17:18:18 <wseltzer> gmandyam: then we'd re-raise the issues at CR, and possibly at charter review
17:18:21 <wseltzer> q-
17:18:37 <wseltzer> nadalin: 479
17:19:03 <apowers> apowers has joined #webauthn
17:19:20 <wseltzer> jeffh: Rolf proposed some changes
17:19:50 <wseltzer> Rolf: my recollection on last week's call, strong objection to all three PRs
17:20:10 <wseltzer> ... I'm happy to work on them, but only if they're going somplace
17:20:27 <wseltzer> nadalin: this one is still marked WD06
17:21:01 <apowers> apowers has joined #webauthn
17:21:11 <wseltzer> dirk: I was happy with this functionality in extension
17:21:43 <jeffh> dirkbalfanz: is happy with having #479 functaionality as an extension, not as a normative part of the spec
17:22:38 <jeffh> rolf: notes that browsers feel that extensions are optional and thus it is unlikely  at this time it wold be implemented
17:22:51 <wseltzer> gmandyam: can any authenticator mechanism be re-proposed as extensions?
17:24:07 <wseltzer> nadalin: if accepted by the group
17:25:13 <wseltzer> nadalin: so authenticator selection has been pushed off to Level 2, but if you'd like to see them as extensions, someone can write them up and propose per normal process
17:25:57 <wseltzer> gmandyam: Qualcomm suggests that we pursue that for all authenticator selection criteria not in the spec now
17:26:12 <wseltzer> ... draft them as client extensions
17:26:38 <wseltzer> nadalin: 484
17:27:25 <wseltzer> https://github.com/w3c/webauthn/pull/484
17:28:30 <wseltzer> gmandyam: we can put in normative requirement that authenticator follow FIDO criteria?
17:28:38 <wseltzer> jeffh: I wouldn't do that
17:28:55 <wseltzer> gmandyam: I wasn't expecting this to be approved as-is, but
17:30:02 <wseltzer> ... with what's there now, an authenticator without rate-limiting would be ok
17:30:17 <wseltzer> jeffh: there are multiple kinds of authenticators and criterial
17:30:23 <wseltzer> s/criterial/criteria/
17:30:45 <wseltzer> gmandyam: jeffh, why don't you write up a proposal?
17:30:50 <wseltzer> gmandyam: Trust path
17:31:05 <wseltzer> ... I don't know if you want to do it as a client-directed extension
17:31:38 <wseltzer> ... if RP won't accept self-authenticated, not sure it makes sense to offer
17:32:40 <wseltzer> jeffh: I haven't looked at the trust path
17:33:03 <wseltzer> jeffh: we don't need rate limiting
17:33:11 <wseltzer> gmandyam: can you create a PR?
17:33:48 <wseltzer> christiaan: if as an RP, we decide not to support osme kind of attestation
17:33:57 <wseltzer> ... I'd think the right thing is to tell the user
17:34:07 <wseltzer> ... "not accepted by your RP"
17:34:38 <wseltzer> ... so even if we (Google) only accepted certain attestations, we'd say bring everything to us so we can give intelligible user message
17:35:53 <wseltzer> jeffh: we're more inclined to accept any authenticator that accepts protocol, better than username-password
17:36:02 <wseltzer> selfissued: from MS, I agree with jeffh
17:36:14 <wseltzer> ... still better than username-password
17:36:37 <wseltzer> gmandyam: if trust anchor is going to be verified at RP, then not a client-directed extension
17:37:00 <wseltzer> ... I don't mind dropping this
17:37:33 <wseltzer> gmandyam: I want to hear more on rate-limiting
17:37:49 <wseltzer> nadalin: close the trust path part; if the rest is still open, discuss next week
17:37:58 <wseltzer> gmandyam: and close Issue 461, to which the trust path responds
17:38:03 <wseltzer> ... call it wontfix
17:38:17 <jeffh> we have a label of "declined"
17:38:41 <wseltzer> nadalin: 487
17:38:48 <wseltzer> jeffh: just do it
17:39:02 <wseltzer> ... editorial
17:39:37 <wseltzer> jeffh: 475, make the spec officially Level 1
17:39:45 <wseltzer> ... matching credential Management
17:39:48 <jeffh> https://github.com/w3c/webauthn/issues/475
17:40:01 <wseltzer> nadalin: will you do that Jeff?
17:40:03 <wseltzer> jeffh: happy to
17:40:12 <wseltzer> Topic: Milestone WD06
17:40:28 <wseltzer> https://github.com/w3c/webauthn/milestone/10
17:40:35 <wseltzer> nadalin: 20 issues
17:42:40 <wseltzer> jeffh: we should decide whether these all need to be done for WD06
17:43:13 <wseltzer> nadalin: we wanted to get to stage where next draft was CR
17:44:46 <wseltzer> selfissued: start by looking at the renames?
17:45:09 <wseltzer> https://github.com/w3c/webauthn/issues?q=is%3Aopen+is%3Aissue+label%3Asubtype%3Arenaming
17:45:48 <wseltzer> nadalin: 79
17:48:00 <wseltzer> jeffh: under 358
17:48:37 <wseltzer> jeffh: editorial cleanup, sloppiness in the spec
17:48:50 <wseltzer> ... 393 and possibly 430 for WD06
17:49:32 <wseltzer> ... 488
17:53:08 <wseltzer> Rolf: 480
17:53:17 <wseltzer> ... I think the algorithm is wrong
17:53:21 <wseltzer> jeffh: I agre
17:53:25 <wseltzer> s/agre/agree
17:55:35 <wseltzer> Rolf: does everyone agree on solution
17:55:40 <wseltzer> jeffh: no. I have to think about it
17:57:17 <wseltzer> ... I believe our intent was just to invoke the authenticator once with the list
17:58:27 <wseltzer> rrsagent, draft minutes
17:58:27 <RRSAgent> I have made the request to generate http://www.w3.org/2017/06/14-webauthn-minutes.html wseltzer
17:58:36 <wseltzer> rrsagent, make logs public
17:58:37 <jeffh> adios
17:58:41 <wseltzer> [adjourned]
17:58:44 <wseltzer> rrsagent, draft minutes
17:58:44 <RRSAgent> I have made the request to generate http://www.w3.org/2017/06/14-webauthn-minutes.html wseltzer
18:00:13 <wseltzer> chair: nadalin
18:00:16 <wseltzer> rrsagent, draft minutes
18:00:16 <RRSAgent> I have made the request to generate http://www.w3.org/2017/06/14-webauthn-minutes.html wseltzer
18:00:39 <wseltzer> present+ christiaan
18:00:47 <wseltzer> rrsagent, draft minutes
18:00:47 <RRSAgent> I have made the request to generate http://www.w3.org/2017/06/14-webauthn-minutes.html wseltzer