15:57:44 RRSAgent has joined #wpwg-spc 15:57:44 logging to https://www.w3.org/2021/06/07-wpwg-spc-irc 15:57:47 Zakim has joined #wpwg-spc 15:57:51 Meeting: SPC Task Force 15:58:01 Agenda: https://lists.w3.org/Archives/Public/public-payments-wg/2021Jun/0001.html 15:58:04 Chair: Ian 15:58:05 Scribe: Ian 15:58:09 present+ 15:59:27 agenda+ Survey to prioritize use cases 15:59:30 agenda+ Issues list review 15:59:36 agenda+ Next meeting 15:59:48 present+ Jean-Carlo_Emer 16:00:42 present+ Rouslan_Solomakhin 16:01:54 present+ Praveena_Subrahmany 16:02:11 present+ Adrian_Hope-Bailie 16:02:16 present+ Chris_Wood 16:03:10 present+ Doug_Fisher 16:03:15 praveena has joined #wpwg-spc 16:03:31 present+ Clinton_Allen 16:03:44 -> https://lists.w3.org/Archives/Public/public-payments-wg/2021Jun/0001.html Agenda 16:04:09 Chris_Wood has joined #wpwg-spc 16:05:21 jcemer_ has joined #wpwg-spc 16:05:26 present+ Laura 16:06:39 present+ Gerhard_Oosthuizen 16:09:12 zakim, close item 1 16:09:12 agendum 1, Survey to prioritize use cases, closed 16:09:13 I see 2 items remaining on the agenda; the next one is 16:09:13 2. Issues list review [from Ian] 16:09:16 zakim, take up item 2 16:09:16 agendum 2 -- Issues list review -- taken up [from Ian] 16:11:08 https://github.com/w3c/secure-payment-confirmation/issues/65 16:11:43 Gerhard: Interesting discussion of "what's stored" v "what's passed as input"? 16:12:08 ...late binding is nice, but what are you registering for? 16:12:19 ...do all the underlying protocols need to pass the data for authentication time? 16:13:56 IJ: What are the benefits to auth-time binding? 16:14:10 Rouslan: (1) Allows credential updates (instead of updating stored information). 16:14:46 (2) If we want to work across multiple profiles or browsers, the way that WebAuthn does that today is data is stored in the authenticator (the browser doesn't store data in webAuthn case) 16:15:28 (3) Private browsing mode is a separate profile; so you could not access the stored data from that mode...but if we pass the data as a parameter, you could still use SPC during a transaction in private browsing mode 16:16:05 ...there is an option question: "What would we do during enrollment?" 16:16:15 ...if the only thing that's created is a credential, do we need UX? 16:16:30 ...we think that the UX is beneficial; we are experimenting with it but don't have enough data yet 16:16:48 ...however, the UX would be a privacy and security requirement if we want to allow enrollment of credentials from an iframe 16:19:04 Gerhard: Thanks for the context. It's not insurmountable for browsers to share state. If I register a credential in a browser and give consent to use my Visa card ... we need to be sure that it's the same card I've consented to use the next time 16:19:45 ...as service provider, we'd like the browser to store the association instead of us having to keep track of some of the information. 16:20:12 AdrianHB: If I enroll a new FIDO credential with an instrument, in the late binding model is there any binding at all? 16:20:26 ...any hints up front to help the user choose the credential I want to use? 16:20:51 ...what's the actual relationship between FIDO token and instrument? 16:21:14 Gerhard: It seems there's no need for instrument registration. You are basically consenting to use a FIDO token to be used for "any payment"; not a specific instrument. 16:21:40 ...it's not clear all the underlying protocols would support passing of data. 16:21:56 q+ 16:22:36 rouslan: We are thinking of multiple instruments should be usable per credential. 16:22:55 ...the user would know how the FIDO credential is being used through the browser-native UX 16:24:05 ...if a bank participates in the WebAuthn ecosystem, what happens if bank loses credential IDs? 16:24:47 ...wondering if it's an issue if a merchant has access to credentials illegitimately; I think it's not a problem since there is still an authorization phase 16:26:26 AdrianHB: RP is responsible for validating instrument is correct. 16:26:43 Rouslan: Correct. In the happy path, the issuer provides a list of credentials and an icon/name and a nonce. 16:26:59 ...the merchant invokes SPC 16:27:29 ...browser gets the icon/name...once user authenticates, authenticator signs over ALL the information provided as input. 16:27:46 ...the relying party can validate the data (also, who is merchant, transaction id (?)) 16:29:25 IJ: Does this work for push payments? 16:29:38 AdrianHB: Whoever authorizes the transaction confirms that what the user saw was ok. 16:34:55 rouslan: We are thinking that no instrument info will be provided. And at authentication time it will be provided. There are tradeoffs to consider if we want to allow both. 16:35:16 ...at enrollment time it might improve enrollment rate to provide instrument information 16:35:28 ...it would be good to experiment with both ways 16:36:22 ...a use case of interest for us is for user to reuse FIDO credential to bank for N cards 16:36:36 Gerhard has joined #wpwg-spc 16:36:42 ..I am leaning more towards "just one way to do it" 16:36:45 q+ 16:36:49 ack me 16:37:10 AdrianHB: This feels like a clean model, but it also allows us to consider payment instruments independent of SPC 16:37:35 ...this flow would be interesting: 16:37:41 * merchant declares payment method support 16:37:47 * browser shows list of instruments 16:37:56 q- 16:37:56 * merchant gets back some blob that can be passed as input to SPC for authentication 16:42:18 Have to drop off guys. 16:42:23 Thanks for a great discussion. 16:42:27 zakim, close item 2 16:42:27 agendum 2, Issues list review, closed 16:42:28 I see 1 item remaining on the agenda: 16:42:28 3. Next meeting [from Ian] 16:42:33 zakim, take up item 3 16:42:33 agendum 3 -- Next meeting -- taken up [from Ian] 16:42:35 21 June 16:42:54 RRSAGENT, make minutes 16:42:54 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian 16:42:59 RRSAGENT, set logs public 16:51:00 RRSAGENT, make minutes 16:51:00 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian 16:51:02 RRSAGENT, set logs public 16:52:53 RRSAGENT, make minutes 16:52:53 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian 16:53:59 RRSAGENT, make minutes 16:53:59 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian 16:56:06 RRSAGENT, make minutes 16:56:06 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian 16:59:29 RRSAGENT, make minutes 16:59:29 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian 17:08:43 RRSAGENT, make minutes 17:08:43 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian 17:10:12 RRSAGENT, make minutes 17:10:12 I have made the request to generate https://www.w3.org/2021/06/07-wpwg-spc-minutes.html Ian