Web Authentication WG -- 12 Jun 2019

jcj_moz: not sure confusion is bad enough to add U2f credential
... I think we might need separate discussion for that
... this can be confusing, but not problematic
... think this can be covered by UX

agl: you are making sense. saying this is just a transition is the least amount of work

elundberg: would changing affect authenticators.
... I don't think so. It would only be issue for duo-protocol authenticators.

agl: aren't all ctap authenticators duo

elunberg: it might not be worth the problem.

dwaite: users will have to figure out which keys and UI.
... other thing would be to have built in support.
... thinking more of a migration detail
... would correlation be an issue?

agl: wwe want to move the U2f interface eventually, but not in the next 5 years

jeffH: is there an issue to submit here.

agl: I could fire one so it is on the list somewhere.
... we could address in web authn and add an extension if we wanted to

elunberg: on #1230 I will make changes
... and should I merge

jeffH: i agree
... agl will submit an issue.

https://github.com/w3c/webauthn/pull/1232

rtony: this is the pass through assertion formats.
... there is lot of negative toward this.

rolf: I don't have update yet. need one more week

Moving to issues

https://github.com/w3c/webauthn/issues/334

tony: akshay is out

jeffH: we probably need to refine some of this.
... understanding of this has been evolving.

https://github.com/w3c/webauthn/issues/863

tony: was kim going to update

jeffH: or I will

elundberg: some looking to close this

tony: Kim was going to create the PR.
... akshay this is not needed.

jbradley: does not think this is needed.

jeffh: maybe this is guidance for UI

tony: this is something you and Kim should work on

jeffH: yes.

https://github.com/w3c/webauthn/issues/465

jeffH: punt. back to discussion with Rolf

https://github.com/w3c/webauthn/issues/872

jeffh: I am working on this right now.
... I am half done already.

https://github.com/w3c/webauthn/issues/1039

elundberg: I'll take a stab at this
... I don't think it needs to make WD 02

tony: when closer to WD-02 we could punt this one.

jcj_moz: this is nice to have, but it is huge
... can we work collaborative on this.
... we can talk offline.

jeffH: put that comment in the issue

https://github.com/w3c/webauthn/issues/1004

jeffH: jc was going to take a look at that.

elundberg: on this topic. the spec is under assumption that browsers do some generic translation, but no browsers are doing that
... so should we update spec?

agl: I don't want that world

selfissue: it is not that black and white
... it references transformation and we should not ignore that
... many of the extensions use this.

eludnberg: ok

selfissue: i will try to put a comment in it. ,

jcj_moz: I had meant to look at it.

https://github.com/w3c/webauthn/issues/1099

jeffH: just editorial to clean up

tony: can we skip over this next time.

jcj_moz: this has come up before
... maybe need a cross reference to people's compliants.

jeffH: not sure what you said applies to #1099

jcj_moz: i'll make not for future reference.

jeffH: excellent

https://github.com/w3c/webauthn/issues/1100

jeffH: editorial cleanup

https://github.com/w3c/webauthn/issues/1101

jeffH: editorial cleanup

https://github.com/w3c/webauthn/issues/1105

jeffh: we should do this. doesn't have to be lots of work

jcj_moz: yes. I can't do PR in near term.

jeffH: assign to me.

https://github.com/w3c/webauthn/issues/1133

jeffH: these are ones that I intend to do - those that are not marked on-going

https://github.com/w3c/webauthn/issues/1147

agl: same as ever

tony: still waiting for some stuff from FIDO land

https://github.com/w3c/webauthn/issues/1149

agl: I will close this one. I don't know who has been agitating on this

shane: it was Christiaan

agl: maybe we should wait.

tony: close?
... wait another week.

https://github.com/w3c/webauthn/issues/1162

elundberg: I intend to do this one

https://github.com/w3c/webauthn/issues/1174

agl: I asked martin to fill in what we do here

tony: i will ask akshay.

https://github.com/w3c/webauthn/issues/1188

jeffH: on my list

https://github.com/w3c/webauthn/issues/1196

jeffH: assigned to Rolf

tony: is this still needed

rolf: you can argue it is needed more than ever.
... giving reasons why certain algorithms are there or not.

tony: is that appropriate?

rolf: we should support algorithms.

tony: let them do their own

rolf: that's what I would say.

tony: what to do?

rolf: there is not a lot of meat here. do we give a public statement?

tony: we don't want to go into detail why each algorithm is used.

rolf: not our decision in the end.

tony: do we just close

rolf: yes.
... our basic attestation is not the best decision from a security perspective.
... this issue is about telling people how to look at algorithms

tony: i think they are looking for cryptographic guidance here
... so close or open

rolf: I vote for close no action.

jcj_moz: i could see a separate doc.

tony: not in the spec

jcj_moz: in spec the move would be to pull algorithms.
... i support closing if we could start planning an "explainer" for implementors
... and also best practices around the algorithms.

selfissue: make that comment and close it.

jcj_moz: OK

https://github.com/w3c/webauthn/issues/1197

https://github.com/w3c/webauthn/issues/1199

jeffH: there is PR open

https://github.com/w3c/webauthn/issues/1200

agl: no plausible action.

tony: so you want to close

agl: i don't think we are going to do anything about it any time soon

alexei: maybe just add a recommendation

agl: lets close it

jeffH: or punt to future