16:52:12 RRSAgent has joined #wpwg-spc 16:52:12 logging to https://www.w3.org/2021/11/08-wpwg-spc-irc 16:52:27 Meeting: SPC Task Force 16:52:29 Agenda: https://lists.w3.org/Archives/Public/public-payments-wg/2021Nov/0001.html 16:52:30 Chair: Ian 16:52:33 Scribe: Ian 16:52:42 I have made the request to generate https://www.w3.org/2021/11/08-wpwg-spc-minutes.html Ian 17:02:27 present+ Anne 17:02:29 present+ Clinton 17:02:32 John_Bradley has joined #wpwg-spc 17:02:34 present+ John_Bradley 17:02:40 present+ Praveena 17:02:42 present+ Sameer 17:02:56 present+ Stephen 17:03:13 present+ Doug_Fisher 17:03:26 Anne has joined #wpwg-spc 17:03:32 present+ JeffH 17:03:36 Topic: What are requirements when more than one SPC credential matches? 17:03:55 present+ Michel Weksler 17:04:08 Stephen: Today in the implementation we accept the first credential that matches. 17:04:16 SameerT has joined #wpwg-spc 17:04:18 clinton has joined #wpwg-spc 17:04:20 ...WebAuthn as a model also views as a decreasing order of pref 17:04:31 ..but they expect prompting of the user to pick the first one they like 17:04:49 John_Bradley: authenticators in CTAP will choose the "most recently created credential" of the allow list. 17:05:37 Ian: Is the goal "get one back however that is determined"? 17:05:51 John_Bradley: Nothing in allow list causes a list to be showing in CTAP 17:06:10 ...nothing about credential IDs says "This is your blue authenticator" 17:06:13 ack Doug 17:06:22 q+ : Ian, can you please run through the problem statement/scenario again 17:06:32 ack Sam 17:06:32 SameerT, you wanted to say Ian, can you please run through the problem statement/scenario again 17:06:54 Doug: From a 3DS perspective it would be great if credentials were shown and nothing else. 17:07:41 ...let's say SPC use case 17:08:01 q+ to ask John to clarify behavior in CTAP vs "WebAuthn Authenticator Model" section of WebAuthn 17:09:25 Stephen: There are two levels: "Multiple authenticators are available" ...may want to ask the user to pick one. 17:09:45 ...when credentials are from the same authenticator...the authenticator picks the most recent one. 17:09:49 ack sm 17:09:49 smcgruer_[EST], you wanted to ask John to clarify behavior in CTAP vs "WebAuthn Authenticator Model" section of WebAuthn 17:10:03 John_Bradley: WebAuthn pretty much always shows you a dialog. 17:10:08 present+ Ryan_Watkins 17:10:14 present+ Christian_Aabye 17:10:41 q+ 17:10:41 John_Bradley: The platform authenticator will give you list of credentials it has and an option to use a roaming authenticator.l 17:10:46 ...lots of innovation in this space 17:10:48 ack SameerT 17:13:46 IJ: Summary: 17:13:52 SameerT_ has joined #wpwg-spc 17:14:02 - When multiple authenticators, should user pick one? 17:14:19 - When multiple credential IDs for the same authenticator, implementation detail how one is chosen. 17:14:33 John_Bradley: Authenticator might show a pick list 17:15:06 ...platform authenticators typically do a user verification before they present a pick list 17:15:50 smcgruer_[EST]: In case where user has one matching platform, the only issue I see is how the browser/OS presents option to plug in a security key 17:15:58 s/security key/roaming authenticator 17:18:07 IJ: should we have requirements? 17:18:28 John_Bradley: If there is an allow list you'll get back one (per CTAP). Windows shows a choosers 17:20:18 Ian: Could we just say "it's up to the implementation to get to 1, and it's an implementation detail?" 17:20:31 John_Bradley: What is the expectation about sequencing of uX? 17:20:47 ...do you silently probe and then go back and do a get() with one credential id? 17:20:59 Stephen: The latter. 17:21:09 1) Browser receives a list of credential IDs. 17:21:24 2) Can ask (in the future) whether the platform authenticator knows it (Conditional UI) 17:21:41 3) our "no match" dialog could be extended to ask user to plug in roaming authenticator 17:22:08 John_Bradley: As long as we say credentials are created with cred protect levels 0 or 2 17:22:42 ...at level 2, you need the credential ID 17:22:55 ..at level 0, there's no privacy as long as the rpid is known 17:23:10 ...Chrome currently uses cred level 2 for discoverable 17:24:05 ...assuming you had, say, a Yubikey, Chrome could iterate over credentials with user presence 0, user verified 0 to determine whether available before user is prompted 17:24:33 ...there's also an NFC use case where user needs to do a tap operation then they might need a dialog 17:25:12 ...may be ok to only present "roaming" option if there's no platform credential available 17:25:28 Stephen: Good question. 17:26:16 John_Bradley: I think in most cases, you'd proceed with the platform authenticator if the issuer has provisioned it 17:26:46 Stephen: I'd be happy to punt to WebAuthn. The WebAuthn implementation could go ahead to resolve it. 17:26:57 Doug: Great discussion. We do have questions on 3DS side re: UX 17:27:17 q? 17:27:19 q 17:27:20 ...we should allow the RP to create more than one credential (may be done at PAN level rather than identity level) 17:27:59 q+ 17:28:02 ...could the OS give an option to insert a roaming authenticator, and if the used it, could the assertion fail if there was no credential...would the RP know? 17:28:12 q- 17:28:25 John_Bradley: That could not happen if you are using an allow list 17:28:52 q+ 17:29:26 John_Bradley: The list of credential ids doesn't tell you about which authenticator (platform or roaming) or if on this machine or not 17:29:48 q- 17:30:08 JeffH: Doug brings up a key question - the data model. 17:30:17 ...the data model needs to get decided 17:30:35 ..if I understood correctly, it's whether the issuer is mapping the credentials to accounts or instruments. 17:30:49 q+ 17:32:27 John_Bradley: If you have one credential per PAN, where does WEbAuthn get info it will present. 17:32:50 Stephen: We don't do instrument selection; the merchant (and account provider) have chosen the instrument before SPC is called 17:34:27 John_Bradley: The answer to the question is "one response". We may want to clarify "what goes in the user id" and we could help avoid a pick list. 17:34:41 Stephen: At registration time, the RP should "be consistent" 17:35:02 John_Bradley: Yes, the RP should be consistent at registration time, otherwise there might be some UX issue. 17:36:30 ACTION: Ian to follow up with Stephen about next steps. 17:36:39 Topic: Next meeting 17:36:54 15 Nov 17:37:03 RRSAGENT, make minutes 17:37:03 I have made the request to generate https://www.w3.org/2021/11/08-wpwg-spc-minutes.html Ian 17:37:12 RRSAGENT, set logs public 17:42:43 zakim, bye 17:42:43 leaving. As of this point the attendees have been Anne, Clinton, John_Bradley, Praveena, Sameer, Stephen, Doug_Fisher, JeffH, Michel, Weksler, Ryan_Watkins, Christian_Aabye 17:42:43 Zakim has left #wpwg-spc 17:42:45 reagent, bye