15:30:00 RRSAgent has joined #wpwg 15:30:00 logging to http://www.w3.org/2017/10/03-wpwg-irc 15:30:08 Meeting: Tokenization Task Force 15:30:12 Chair: Ian 15:30:35 agenda: https://lists.w3.org/Archives/Public/public-payments-wg/2017Oct/0002.html 15:30:57 present+ 15:31:08 present+ SteveSommers 15:33:31 lte has joined #wpwg 15:35:14 Ken has joined #wpwg 15:35:20 Simon has joined #wpwg 15:38:36 MANASH_MC has joined #WPWG 15:44:54 +Q 15:45:30 [10:34] present+ Ken 15:45:30 [10:34] present+ Olivier 15:45:30 [10:34] present+ SimonDix 15:45:30 [10:36] Topic: TPAC agenda planning 15:45:30 [10:36] https://github.com/w3c/webpayments/wiki/FTF-Nov2017 15:45:31 [10:38] present+ Laura 15:45:33 [10:38] present+ Manash 15:45:35 [10:39] Demo (Manash/Sachin) and report on experience with network tokenization spec. 15:45:37 [10:39] 3DS 2.0, UX, Regulatory overview, Benefits to W3C members 15:45:41 [10:39] How can 3DS 2.0 scale through PR API 15:45:43 [10:39] Manash: EMVCo is coming out with 3DS 2.0 15:45:45 [10:40] ...it's a vast improvement...several reasons it's important: 15:45:47 [10:40] - regulatory 15:45:49 [10:40] ....in some markets 2-factor auth is required 15:45:51 [10:40] ...but the user experience can be klunky 15:45:53 [10:41] ...but potentially 95% of the time step up will not be required (to strong auth) 15:45:55 [10:41] - 3DS 2.0 does improve the approval rates (for CNP) 15:45:57 [10:41] in the US 1 in 6 transactions is declined. 3DS 2.0 is supposed to increase acceptance rates 15:45:59 [10:42] - Liability shift may also be possible in some jurisdictions 15:46:01 [10:42] ...but 3DS 2.0 has costs - scalability, .... 15:46:03 [10:42] ...what we want to focus on TPAC is: 15:46:05 [10:43] 1) benefit of 3DS 2.0..and can we create a scalable model on top of PR API that allows merchants to accept 3DS 2.0 without setting up a 3DS 2.0 server 15:46:08 [10:44] ...there is a potential scalable solution to make it less burdensome on the merchant 15:46:12 [10:45] IJ: what might we get to see about network tokenization payment method? 15:46:14 present+ Ken 15:46:16 present+ Olivier 15:46:18 present+ SimonDix 15:46:20 present+ Laura 15:46:22 present+ Manash 15:46:28 Manash: At TPAC what we are hoping to show how you create a scalable format using network tokens 15:47:08 ...we want to move away from Basic Card and from custom payment methods 15:47:28 ...we want merchants to be able to say "I accept network tokens" and allow any payment app to return a token 15:47:45 ...we will have a design and roadmap at TPAC 15:48:09 ack Ken 15:48:26 Ken: +1 to Manash's agenda 15:48:49 https://w3c.github.io/webpayments-methods-tokenization/index.html 15:50:04 https://github.com/w3c/webpayments-methods-tokenization/wiki/Network-Tokens 15:51:01 Manash: The wiki reflects our more recent understanding. 15:51:25 Manash: Note that 3DS 2.0 is independent of tokenization (can be used with basic card) 15:53:22 IJ: to ensure this work is understood: 15:53:25 a) What are the delviearbles? 15:53:32 2) Make sure our rechartering includes that in scope 15:54:14 Last edited in august => https://github.com/w3c/webpayments-methods-tokenization/wiki/Network-Tokens 15:54:49 ACTION: Ian to update the network token payment method to include the data model in the wiki 15:54:50 'Ian' is an ambiguous username. Please try a different identifier, such as family name or username (e.g., IFSF-EFT-WG-Lead, ijacobs, ijmad). 15:54:55 "Tokenized Card Payment" 15:55:07 IJ: What title should we give that spec? 15:58:26 Manash: Network / Issuer Tokenized Card Payment 15:58:41 IJ: Let's keep short title and move details to abstract 15:59:17 Manash: In a couple of weeks we will have more clarity on when we will have a demo with worldpay 15:59:53 ...I would also like to understand how other players in the ecosystem are planning to work with a tokenization standard. 16:02:28 q? 16:02:40 Topic: Encrypted Card 16:02:49 IJ: Any news or updates? 16:03:03 Olivier: No updates. I still plan to build a prototype for TPAC 16:04:01 Ian: you're dropping off 16:04:32 Ian: maybe you can try dropping video? 16:05:26 Value proposition for encrypted: 16:05:33 * World where user does not yet have payment app that does tokenization 16:05:54 * World of PCI exposure even when third party using iframe 16:06:49 * Where merchant wants to control routing and therefore ok to get data itself; just wants that data to be opaque 16:08:15 IJ: We should be able to articulate the value proposition and who the interested parties are. 16:08:28 Manash: Where is the card being encrypted? 16:08:33 Olivier: In the user agent (or other payment app) 16:08:40 https://github.com/w3c/webpayments-methods-tokenization/wiki/encrypted_card 16:12:20 We characterize this as "transitional" payment method prior to broad adoption of network tokens 16:12:25 Manash: interesting! 16:13:15 ...also interested in relationship to dynamic CVV etc. 16:13:48 ...what if the browser calls a server that provides a dynamic CVV 16:13:56 ..then the browser doesn't have to ask the user to enter a CVV code 16:15:09 olivier: Background transactions also interesting...how does dynamic cvv work in subscription world? 16:15:19 Manash: You have card data on file but don't store the CVV... 16:15:43 ...there's a call to the server when payment (subscription transaction) required, so get a dynamic cvv at the transaction time 16:16:12 Oyiptong: The added security is the ability to deny the transaction before it's made? 16:16:30 Manash: Rather, the data is dynamic (so more secure)...whether cvv or expiry date 16:16:43 ...one question is "who can generate that data?" it's either banks or networks 16:17:37 IJ: Is this still Basic Card though from the merchant perspectiv? 16:17:40 Manash: Yes 16:18:51 IJ: Do we need a different payment method identifier for social reasons? (e.g., so merchants can say "I did not get basic card back") 16:19:29 Manash: Or maybe there is a user experience change (e.g., no input for CVV; call a server instead) 16:19:41 ...merchant cannot store the data it receives 16:20:31 ...so probably need to signal to back end that some data cannot be stored 16:24:05 IJ: Should we turn encrypted card into a payment method spec? 16:25:01 ...let's keep as wiki (dropping part II) and if WG supports adopting it, give it a new repo 16:25:21 Topic: next meeting 16:25:50 q+ 16:25:58 ack oy 16:26:17 oyiptong: I want to talk to Andre about encrypted card 16:27:49 ack oy 16:28:34 Proposed 24 October 16:28:42 (WRONG) 16:29:17 Things we can do at a call before TPAC: 16:29:19 * Review draft presentations 16:29:24 * Review updated payment method specs 16:29:59 NEXT MEETING: 17 October 16:30:12 agenda: 16:30:18 * Check on Olivier outline 16:30:23 * Check on Ian's network tokenization spec edits 16:30:44 RRSAGENT, make minutes 16:30:44 I have made the request to generate http://www.w3.org/2017/10/03-wpwg-minutes.html Ian 16:30:53 RRSAGENT, set logs public