15:58:22 RRSAgent has joined #wpwg-spc 15:58:22 logging to https://www.w3.org/2021/08/30-wpwg-spc-irc 15:58:26 Meeting: SPC Task Force 15:58:28 Chair: Ian 15:58:34 Agenda: https://lists.w3.org/Archives/Public/public-payments-wg/2021Aug/0039.html 15:58:44 Scribe: Ian 15:58:46 present+ 15:58:58 present+ John_Bradley 16:00:10 present+ Gerhard_Oosthuizen 16:01:04 present+ Clinton_Allen 16:01:17 present+ Doug_Fisher 16:01:40 clinton has joined #wpwg-spc 16:02:38 present+ Bastien_Latge 16:02:48 present+ Susan_Pandy 16:03:12 Topic: Pull request 120 16:03:17 Ian: Ok @goosth? 16:03:30 present+ Michel_Weksler 16:03:32 mweksler has joined #wpwg-spc 16:03:48 present+ Adrian_Hope-Bailie 16:04:08 Topic: Editor thanks! 16:04:21 present+ Stephen_McGruer 16:05:02 FPWD is tomorrow! 16:05:30 Topic: Chrome updates? 16:06:00 Stephen: Chatted with WebAuthn WG last week; expect more discussion next week. No actions yet. 16:06:19 ...we have filed an intent to ship in 95; not a guarantee but we hope to have it there. 16:06:33 John_Bradley: M95 where? 16:06:37 Stephen: MacOS and Windows 16:07:03 John_Bradley: How are you doing it on Windows? WebAuthn.dll v1 doesn't have any way to track cross-origin flag. 16:07:30 ...the question is: how does the platform authenticator differentiate SPC v other FIDO credentials? 16:07:35 jonathan__ has joined #wpwg-spc 16:07:47 present+ 16:07:50 Stephen: I don't think today it's the job of the platform authenticator. We have a local browser list implementation today (not the long-term plan) 16:08:30 present+ Sameer_Tare 16:08:58 Stephen: Temporary in-browser storage today; various proposals being discussed (e.g., CTAP, or discoverable credentials) 16:09:43 John_Bradley: Windows doesn't have non-discoverable-credentials. 16:10:32 ..in principle SPC credentials are non-discoverable 16:10:38 stephen: Yes, when used in a 3p context 16:11:14 IJ: What does the spec need to say? 16:11:49 Stephen: I was waiting to chat with WebAuthn folks before adding some info to the spec. 16:11:58 John_Bradley: LargeBlob is a viable option. 16:12:45 ...best thing is to have an extension IMO and store information in authenticator. 16:13:00 ...could be a Webauthn extension (inherited by CTAP) 16:13:24 ...there's no reason the extension couldn't also be passed to the authenticator 16:13:37 ...the question is how the authenticator tells the platform that it is one kind of credential or another 16:14:00 Stephen: Long term, what I'm hoping to do is that the necessary APIs for conditional UI should enable this use case. 16:14:25 ...what we need is the ability to say "Does this credential match?" without a user interaction.... 16:15:38 AdrianHB: Is our use case in front of conditional UI folks? 16:15:42 Stephen: Yes from Google side 16:16:04 John_Bradley: People aren't necessarily thinking how this will work with caBLE 16:16:37 ...how do private APIs talk to internal authenticator....we need to think about how this works with roaming authenticators 16:16:47 Stephen: I agree. 16:16:55 Gerhard_ has joined #wpwg-spc 16:17:14 ...what I'm hoping to see is that, with this initial version, we will prove the value and then we extend to roaming, caBLE, etc. 16:18:13 q? 16:19:04 question: Will SPC work across all Platform Authenticators today (WebAuthn Level 1) 16:19:43 Gerhard: Will M95 work on Android? 16:20:07 ...will M95 work on existing Windows and MacOS versions shipping today? 16:20:36 Stephen: Windows and MacOS works today with existing libraries today 16:20:49 ..but we are waiting for Android to add discoverable credentials before we support SPC on Android 16:21:05 Ian: What is that timeline? 16:22:08 Topic: Issue 101: Proposal: support data URIs for card art icons 16:23:18 Ian: Doug indicated probably suffices to has the URL (not the data) 16:23:52 Stephen: Current implementation is to sign the URL. 16:24:05 John: The authenticator signs a hash of client data. 16:24:18 Stephen: Cripes! You're right! 16:25:09 AdrianHB: We don't have to has the data, but we should sign the image data (e.g., base 64). You don't need to hash it. 16:25:34 John: Put the information in client data (e.g., base 64 url encoded or whatever) 16:25:47 Stephen: It does mean that whatever has to be sent to the RP may be quite large 16:26:04 ....what is the hash also in webAuthN? 16:26:17 John_Bradley: SHA256. Just the one algorithm. 16:27:25 Stephen: the original problem is that I thought the authenticator would not like the large blob, not realizing that it would be hashed before hitting the authenticator. Sorry about that! 16:27:36 I have made the request to generate https://www.w3.org/2021/08/30-wpwg-spc-minutes.html Ian 16:28:26 Stephen: So first problem not a problem. 16:28:40 John_Bradley: The RP should have the image. They keep the challenge. Why can't they keep the image? 16:29:08 Stephen: So "URL or image data"? 16:30:37 John_Bradley: Signing over URL probably not useful for embedded flows. The Verifier doesn't know what the URL pointed to. 16:32:38 John_Bradley: What was the feedback from Apple and Firefox on displaying image URLs in this as opposed to structured data? 16:32:58 ...somebody else could use this API for displaying arbitrary (nefarious) images 16:33:10 ..if it's an image URL, people will try to use it to sign for property purchases or other things 16:33:31 Stephen: Hoping to get more input from Mozilla and Apple. 16:33:52 ..regarding URL...it's just to an image 16:33:58 John_Bradley: Ah, ok 16:34:17 ..this is just for confirmation of what card image was used. 16:34:24 Stephen: I suspect RPs will not check this field. 16:34:30 John_Bradley: Agreed. 16:35:00 ..if just the card image, just sign a hash of the argument that was passed. 16:35:11 ...let the RP cache that. 16:35:38 Topic: Next meeting 13 September 16:35:41 (No meeting on the 6th) 16:36:23 RRSAGENT, make minutes 16:36:23 I have made the request to generate https://www.w3.org/2021/08/30-wpwg-spc-minutes.html Ian 16:36:27 RRSAGENT, set logs public 18:32:33 zakim, bye 18:32:33 leaving. As of this point the attendees have been Ian, John_Bradley, Gerhard_Oosthuizen, Clinton_Allen, Doug_Fisher, Bastien_Latge, Susan_Pandy, Michel_Weksler, 18:32:33 Zakim has left #wpwg-spc 18:32:35 rrsagent, bye 18:32:35 I see no action items