18:52:17 <RRSAgent> RRSAgent has joined #webauthn
18:52:17 <RRSAgent> logging to https://www.w3.org/2021/08/25-webauthn-irc
18:52:19 <Zakim> RRSAgent, make logs Public
18:52:20 <Zakim> Meeting: Web Authentication WG
18:52:25 <wseltzer> Agenda: https://lists.w3.org/Archives/Public/public-webauthn/2021Aug/0126.html
18:58:56 <addison> present+
18:59:17 <wseltzer> present+
18:59:24 <wseltzer> chair: Nadalin, Fontana
19:00:48 <wseltzer> present+ nadalin, fontana, akshay, rouslan, sbweeden
19:01:15 <jfontana> jfontana has joined #webauthn
19:01:28 <jfontana> present +
19:01:45 <nina> nina has joined #webauthn
19:03:48 <smcgruer_[EST]> smcgruer_[EST] has joined #webauthn
19:05:16 <elundberg> elundberg has joined #webauthn
19:05:23 <wseltzer> present+ agl, christiaan_brand, dirk_balfanz, ken_buchanan, liquian_max_gu, michael_knowles, nina_satragno, rae_rivera, smcgruer, tim_cappalli, zakaria_ridouh
19:05:39 <wseltzer> present+ elundberg, kaan_icer, nsteele
19:08:54 <jfontana> wendy: charter is out for review
19:09:09 <jfontana> present+
19:09:33 <jfontana> tony: Addison here to talk about internationalization
19:09:34 <wseltzer> Topic: Internationalization
19:10:34 <wseltzer> https://github.com/w3c/webauthn/issues?q=is%3Aissue+is%3Aopen+label%3Ai18n-needs-resolution
19:11:00 <jfontana_> jfontana_ has joined #webauthn
19:11:31 <jfontana_> addison: ripping out what was added was just going backward.
19:11:46 <wseltzer> addison: ripping out your changes would give a string with no language metadata
19:11:47 <jfontana_> ...preference is for additional metadata fields
19:11:54 <wseltzer> ... that could be acceptable
19:12:09 <wseltzer> ... Or we'd prefer additional metadata
19:12:32 <wseltzer> ... if you really needed to include metadata in the string, we'd suggest serialization a la RDF
19:12:41 <wseltzer> ... would appreciate your guidance on constraints
19:12:46 <wseltzer> agl: constraints
19:12:56 <wseltzer> ... hardware that exists only accepts a fixed number of bytes
19:13:11 <wseltzer> ... we  could rev the hardware spec, but that would take years to become prevalent in the wild
19:13:23 <wseltzer> ... so adding new fields, we expect wouldn't work terribly well
19:13:32 <wseltzer> addison: would that also be true re encoding into string?
19:13:41 <wseltzer> agl: devices take a lump of bytes
19:13:52 <wseltzer> ... where we can put anything. (some have screens)
19:13:52 <dveditz> dveditz has joined #webauthn
19:14:01 <wseltzer> ... they're free to truncate arbitrarily
19:14:03 <dveditz> present+
19:14:07 <wseltzer> ... needs to decay gracefully
19:14:25 <wseltzer> ... You could imagine API has fields we'd like and the browsers are tasked with encoding
19:14:34 <wseltzer> ... which we'd have to specify
19:14:45 <wseltzer> ... it's possible the encoding could happen at browser rather than RP
19:15:04 <wseltzer> addison: my concern, suppose we go down the path of cleanup
19:15:16 <wseltzer> ... language string followed by garbage
19:15:25 <wseltzer> ... new implementations would have to know about that
19:15:57 <wseltzer> ... we like separate metadata fields so old things don't have to know about it or care
19:16:40 <wseltzer> addison: the characters you're talking about are deprecated
19:17:10 <wseltzer> ... it wouldn't be fatal if those were displayed as hollow boxes or flags
19:17:18 <wseltzer> ... newer implementations would know how to read
19:17:40 <wseltzer> agl: three places of design
19:17:56 <wseltzer> ... separate fields pushed down to device, wait until 2024 CTAP spec
19:18:14 <wseltzer> ... metadata stretched down to the browser, who stuff it into byte strings
19:18:31 <wseltzer> ... RPs can encode this information (what we have in l2)
19:18:41 <wseltzer> addison: these fields shown to users when?
19:19:07 <wseltzer> agl: on fresh sign in, browser shows strings from security key to user, as name of account
19:19:17 <wseltzer> addison: so they do need to be human-readable
19:19:27 <wseltzer> agl: the names come from a website
19:20:14 <wseltzer> ... as in, "here's an account called Alice"
19:20:36 <wseltzer> johnbradley: 2 strings, a friendly name and an account identifier
19:21:12 <wseltzer> elundberg: API also has website name and friendly name
19:21:53 <wseltzer> addison: trying to get a sense of importance
19:22:03 <wseltzer> ... of doing things with metadata
19:22:35 <wseltzer> ... I can imagine things where it would be rendered incorrectly without language to select fonts, text direction
19:22:45 <wseltzer> ... but ok to take time to get right
19:23:42 <wseltzer> addison: I probably need to talk to our i18n WG
19:24:07 <wseltzer> ... It would be good if we could disappear the existing text pending new text
19:24:24 <wseltzer> ... we need to choose between add'l metadata with long lead time vs encodin in string
19:24:31 <wseltzer> s/encodin/encoding/
19:24:45 <wseltzer> addison: I'm in minority in WG proposing putting metadata at the end
19:24:52 <wseltzer> ... so that's what's lost in truncation
19:25:08 <wseltzer> ... others think putting metadata in front is right
19:25:13 <wseltzer> agl: I agree with you
19:25:47 <wseltzer> johnbradley: authenticators have fixed amount of storage, the more you allocate to identifiers, the fewer credentials you can have
19:27:27 <wseltzer> agl: authenticators have fixed lengths
19:27:43 <wseltzer> ... so have to reserve the max legth
19:28:48 <wseltzer> addison: serialization as in RDF...
19:29:01 <wseltzer> agl: a marker at the end is useful too, so if that's missing, we know truncation has occurred
19:29:10 <wseltzer> nadalin: timing?
19:29:34 <wseltzer> addison: why don't we target 8 September for an update
19:29:47 <wseltzer> nadalin: thanks, and if needed, we can reschedule
19:30:03 <wseltzer> addison: any other questions on other issues?
19:30:53 <wseltzer> Topic: Christiaan on WebAuthn for Payments
19:31:13 <wseltzer> christiaan: and Stephen
19:32:01 <wseltzer> -> Slides https://lists.w3.org/Archives/Public/public-webauthn/2021Aug/att-0129/_WebAuthn_WG_August_2021__Secure_Payment_Confirmation.pdf
19:32:28 <wseltzer> [ smcgruer shows slides ^ ]
19:34:10 <wseltzer> s/Christiaan on/Christiaan and Stephen on SPC,/
19:35:59 <wseltzer> smcgruer_[EST]: motiviation for https://github.com/w3c/webauthn/issues/1656
19:42:54 <wseltzer> johnbradley: what's different about the payment context credential
19:43:11 <wseltzer> smcgruer_[EST]: the difference is triggered by passing the payment extension
19:43:36 <wseltzer> christiaan: it's a webauthn extension
20:00:14 <wseltzer> [to be continued]
20:00:24 <wseltzer> [adjourned]
20:06:44 <wseltzer> rrsagent, draft minutes
20:06:44 <RRSAgent> I have made the request to generate https://www.w3.org/2021/08/25-webauthn-minutes.html wseltzer