W3C

- DRAFT -

Web Authentication Working Group Teleconference

17 Jan 2018

Attendees

Present
jeffh, jcj_moz, weiler, nadalin, elundberg, gmandyam, apowers, christiaan, jfontana, JohnBradley, Rolf, selfissued, agl, wseltzer
Regrets
Chair
nadalin, jfontana
Scribe
jfontana

Contents


tony: let's look at PR 510

<jeffh> https://github.com/w3c/webauthn/pull/510

https://github.com/w3c/webauthn/pull/510

thanks, jeff

Giri: couple of editorial changes

gmandyam: jeff I address your ed. change will you approve them. I will take care of it.
... I will do it this afternoon

tony: let's got to #724,

https://github.com/w3c/webauthn/pull/724

tony: I don't think jeff has looked at what you wrote back

gmandyam: given reent changes I am a bit clearer
... I am aiming for consistency, something in JSON formattable, and CBOR map compatible.
... I think I am ok with the latest

selfissued: why is this talking about biometric authenticator?

gmandyam: there is nothing in the diff

<jeffh> https://github.com/w3c/webauthn/pull/724/files

selfissued: yes, this is in the diff.

gmandyam: I can get rid of that; good catch.
... I will clean it up.

tony: https://github.com/w3c/webauthn/pull/623
... jeffrey is not on the line

jeffH: I need to re-review.

tony: mike and rolf have signed off.

Jcjones: I thought I was removed. I did not review

emil: seems like biometrics from last PR look like they were left over from commits

elundberg: if 510 is merged, this might not show up in the diffs anymore

https://github.com/w3c/webauthn/pull/718

tony: I thnk we are pretty much signed off, if Mike wants to look at this

elundberg: this is based on 713, it's a bit vague. this is in RP operations, may be confusing to refer to browser operations
... {PR is ready to go if we want to merger, not sure we should

selfissued: seems to have a lot of unrelated changes. what is the intended change?

elundberg: I could close and isolate the changes. if you want that....
... OK. I will do that

selfissued: PR should not have a bunch of noise.
... can we make two new ones

elundberg: i agree

jeffH: yes

https://github.com/w3c/webauthn/pull/737

tony: selfissued opened
... did everyone agree to jeffH change request

selfissued: there are approvals from jcjones; two other approvals.

tony: I prefer jeffH review and sign-off

jeffH: this is comment frmo AGL

AGL: is here

<jeffh> https://github.com/w3c/webauthn/pull/737#discussion_r160761084

AGL: I can't review this on the fly

tony: when you get time

AGL: yes, will do.

tony: that takes us through the open PRs
... lets look at open issues on milestone CR

https://github.com/w3c/webauthn/issues/133

tony: still pending I believe
... selfissued and gmandyam have commented

<jeffh> https://github.com/w3c/webauthn/issues/133#issuecomment-352896653

selfissued: can you write a PR gmandyam

tony: gmandyam will take the lead

https://github.com/w3c/webauthn/issues/184

jeffH: elundberg asserts this can be closed.

tony: elundberg can you close this one
... we are closing 184

jeffH: PR 687 addresses this

elundberg: will add comments on hot plugging other issues

https://github.com/w3c/webauthn/issues/204

jeffH: someone needs to write up a PR on it
... tony assigned selfissued in Nvo.

selfissued: I am reading the issue and see if there is proposed text.
... is there actionable text in the issue. I can't figure it out

elundberg: thinks this is related to #184.

selfissued: close this with comments and say actiaonble text needs to be provided and have it remain closed

jeffH: summary of privacy review was.....204 is in that class RP driven de-anonymization
... why don't I assign myself to 204

selfissued: thank you

https://github.com/w3c/webauthn/issues/372

tony: akshay could not make it today, mike was going to take.
... selfissued can you get with akshay on #372

selfissued: I will do that

https://github.com/w3c/webauthn/issues/394

jeffH: It was assigned to selfissued (mike)

selfissued: i think I know what to do.

tony: thank you

https://github.com/w3c/webauthn/issues/565

jeffH: need to reassign; jeffrey does not have time

tony: assign to selfissued to write a PR

jcjones: is going to take my earlier comments and throw those in. This one might do something in the future; not much now

tony: OK. lets see where it goes

https://github.com/w3c/webauthn/issues/570

tony: think selfissued needs to reference CTAP and it is done

selfissued: ok

https://github.com/w3c/webauthn/issues/626

tony: this has been here quite a while.

selfissued: i know what to do here. I needed to get CTAP bikeshed stable.

https://github.com/w3c/webauthn/issues/645

jeffH: its on the queue

https://github.com/w3c/webauthn/issues/647

jeffH: this is on the queue.

https://github.com/w3c/webauthn/issues/658

JeffH: I need to add a note....

https://github.com/w3c/webauthn/issues/694

jeffH. AGL has a PR #781

AGL: I submitteed just before the call. will look at it next week.

https://github.com/w3c/webauthn/issues/713

elundberg: we might not want to do that. in favor of closing

tony: OK. any problems?

jcjones: I think that is a good plan.

elundberg will close

https://github.com/w3c/webauthn/issues/715

tony: jcjones has looked at this

jcjones: I think we can close

jeffH: i think this is fine.

jcjones: yes, I will close/

https://github.com/w3c/webauthn/issues/742

gmandyam: can we go back. to 725
... if we are going to do that we need to do it for every single extension

selfissued: I wil read all this and make sure it is conforment

AGL: understanding that we would not have generic forwarding..

selfissues: that is not true. custom tranformation are the problem

AGL: so what is the expectation

selfissued: I can write note saying custom translations are not recommended

agl: seems wishy-washy

selfissued: this is case where authenticator needs to be able to reject.
... there is not a security or implementation, it jsut doesn't work
... we are talking about two separate things. I won't change canonical lanaguage

jbradley: there have to be some decision on what you do with those things

agl: only ambiguity is around numbers, ban non-integers

jeffH: I think we did that..

selfissued: ... can we create a CTAP issue and assign it to me with lang. about float and ... extensions

jeffH: I can do that

back to: https://github.com/w3c/webauthn/issues/742

tony: this one..wanted to reference batch. AGL had concerns over citing FIDO stuff in this spec

AGL: agrees that is reasonable. I don't know if this is a CR milestone thing

tony: why I would include, we did have the call with Privacy Interest Group

AFL: i will come up with PR by next week

correction AGL

jeffH: this should be PR milestone

<jcj_moz> https://github.com/w3c/webauthn/issues/743

tony: this one came up on PING call, also. Privacy Interest Group
... does this get folded in?

jeffH: this is kind of an umbrella issue that is ref. from 204 and 184
... addressing 204 and 184 went away.

tony: what do we do

jeffH: 204 may make 743 go away.
... have 204 included fix for 743

selfissued: that's fine

https://github.com/w3c/webauthn/issues/744

gmandyam: wil adress with 133

tony: close it, gmandyam. 744

https://github.com/w3c/webauthn/issues/745

tony: we talked about

jeffH: i am assigned
... lets take a shot at closing

tony: this takes us through the issues.

tony" let's discuss next week and close some things down

jeffH: need to triage 750

no meeting next week.

ok

jeffH: AGL is suggesting we could remove notes and say we need to pass in a challenge

jcjones: this deserves more conversation
... but we may end up doing this

end

<jeffh> I note that we did not assign https://github.com/w3c/webauthn/issues/750 to a milestone...

Summary of Action Items

Summary of Resolutions

[End of minutes]

Minutes formatted by David Booth's scribe.perl version 1.152 (CVS log)
$Date: 2018/01/17 19:04:38 $

Scribe.perl diagnostic output

[Delete this section before finalizing the minutes.]
This is scribe.perl Revision: 1.152  of Date: 2017/02/06 11:04:15  
Check for newer version at http://dev.w3.org/cvsweb/~checkout~/2002/scribe/

Guessing input format: Irssi_ISO8601_Log_Text_Format (score 1.00)

Present: jeffh jcj_moz weiler nadalin elundberg gmandyam apowers christiaan jfontana JohnBradley Rolf selfissued agl wseltzer
No ScribeNick specified.  Guessing ScribeNick: jfontana
Inferring Scribes: jfontana

WARNING: No "Topic:" lines found.

Found Date: 17 Jan 2018
People with action items: 

WARNING: No "Topic: ..." lines found!  
Resulting HTML may have an empty (invalid) <ol>...</ol>.

Explanation: "Topic: ..." lines are used to indicate the start of 
new discussion topics or agenda items, such as:
<dbooth> Topic: Review of Amy's report


WARNING: IRC log location not specified!  (You can ignore this 
warning if you do not want the generated minutes to contain 
a link to the original IRC log.)


[End of scribe.perl diagnostic output]