18:20:11 <RRSAgent> RRSAgent has joined #webauthn
18:20:11 <RRSAgent> logging to https://www.w3.org/2021/08/11-webauthn-irc
18:20:13 <Zakim> RRSAgent, make logs Public
18:20:15 <Zakim> Meeting: Web Authentication WG
19:00:57 <wseltzer> present+
19:01:15 <elundberg> elundberg has joined #webauthn
19:01:48 <wseltzer> regrets+ Nadalin
19:02:06 <wseltzer> present+ jfontana, akshay, davidwaite, elundberg, sbweeden
19:03:04 <wseltzer> present+ Rae
19:04:30 <wseltzer> present+ timcappalli
19:05:54 <wseltzer> Topic: Charter
19:06:10 <wseltzer> wseltzer: just getting the final comments from team for Director review, should go to AC review soon
19:06:13 <wseltzer> topic: PRs
19:06:28 <wseltzer> chair: jfontana
19:06:46 <wseltzer> elundberg: Most of my PRs, waiting review from JeffH
19:07:19 <wseltzer> ... PR 1660, I'm not sure whether it's good. Thoughts?
19:07:24 <wseltzer> ... please review
19:07:41 <wseltzer> https://github.com/w3c/webauthn/pull/1660
19:07:47 <wseltzer> sbweeden: I'll review
19:07:55 <wseltzer> agl: I just clicked approve
19:08:04 <wseltzer> present+ agl
19:10:13 <wseltzer> sbweeden: "chosen by authenticator or client"?
19:10:20 <wseltzer> agl: "not chosen by RP"?
19:10:57 <wseltzer> jfontana: https://github.com/w3c/webauthn/pull/1661
19:11:08 <wseltzer> elundberg: this was just a bikeshed warning fix
19:11:37 <wseltzer> ... to fix the dictionary
19:12:24 <wseltzer> jfontana: https://github.com/w3c/webauthn/pull/1622
19:12:48 <wseltzer> elundberg: waiting for Jeff
19:13:05 <wseltzer> ... as is 1621
19:13:50 <wseltzer> sbweeden: it was waiting on a different PR
19:14:01 <wseltzer> elundberg: and the other is now ready to be merged
19:14:41 <wseltzer> ... I'll merge 1649 into this branch, as it was all approved
19:15:26 <wseltzer> jfontana: Now to issues
19:15:49 <wseltzer> ... https://github.com/w3c/webauthn/issues/1656
19:16:15 <wseltzer> present+ dveditz
19:17:32 <wseltzer> akshay: no objection from me, want to hear from Mozilla
19:18:03 <wseltzer> jfontana: needs more input
19:19:00 <wseltzer> dveditz: I'd have to go back to those who commented
19:19:11 <wseltzer> agl: I think the objection then was to lack of use case
19:20:04 <wseltzer> dveditz: I'll ask. Spec doesn't like to make UI prescription, but so long as it's clear to the user
19:20:28 <wseltzer> agl: we're assuming we can convey to user cross-origin communication
19:20:37 <wseltzer> ... for federation, as well as for this
19:21:14 <wseltzer> dveditz: similar issue with OAuth in frames vs popups
19:21:59 <wseltzer> jfontana: 1657
19:23:40 <wseltzer> ... let's update
19:23:46 <wseltzer> ... 1658
19:23:55 <wseltzer> agl: device-bound keys, from another issue
19:24:12 <wseltzer> ... value of sites being able to have concept of "same device"
19:24:26 <wseltzer> ... as a signal to risk engine
19:24:47 <wseltzer> ... I retired a previous issue on the same topic
19:25:05 <wseltzer> jfontana: leave open for some discussion?
19:25:25 <wseltzer> agl: we'll likely start with 1637 first
19:26:34 <wseltzer> jfontana: 1659
19:26:46 <wseltzer> agl: elundberg's PR will close this when landed
19:26:53 <wseltzer> jfontana: 1662
19:28:15 <wseltzer> jfontana: 1640?
19:28:39 <wseltzer> akshay: just gathering feedback. will remain there for a while. Mark as L3
19:29:21 <wseltzer> jfontana: 1639
19:29:39 <wseltzer> agl: likely addressed by 1637
19:34:24 <wseltzer> jfontana: 1630
19:34:29 <wseltzer> ... hearing no objections to closing
19:35:12 <wseltzer> jfontana: 1617
19:35:37 <wseltzer> agl: question of what value to pick, if we think there should be a max credential ID length
19:36:41 <wseltzer> elundberg: no bigger than fits in CTAP
19:37:01 <wseltzer> agl: I'll address
19:37:10 <wseltzer> jfontana: 1612
19:37:34 <wseltzer> akshay: can close
19:40:56 <wseltzer> agl: scope as device vs app
19:41:40 <wseltzer> davidwaite: how does this work with CaBLE?
19:42:10 <wseltzer> agl: phone authenticator, a device with app-scoped keys would use a different key for app vs web
19:42:41 <wseltzer> davidwaite: viable cross-device?
19:43:20 <wseltzer> agl: what app is CABLE? that's up to the implementation
19:47:54 <wseltzer> jbradley: I'd prefer not to have to support it on roaming authenticators
20:00:52 <wseltzer> jfontana: longer discussion, let's keep it open
20:00:55 <wseltzer> [adjourned]
20:00:58 <wseltzer> rrsagent, draft minutes
20:00:58 <RRSAgent> I have made the request to generate https://www.w3.org/2021/08/11-webauthn-minutes.html wseltzer