13:01:50 RRSAgent has joined #wot-sec 13:01:50 logging to https://www.w3.org/2022/12/05-wot-sec-irc 13:02:41 McCool has joined #wot-sec 13:03:46 meeting: WoT Security 13:03:58 present+ Kaz_Ashimura, Michael_McCool, Jiye_Park 13:03:59 Jiye has joined #wot-sec 13:04:11 chair: McCool 13:04:36 agenda: https://www.w3.org/WoT/IG/wiki/IG_Security_WebConf#5_December_2022 13:07:36 present+ Kaz_Ashimura, Michael_McCool, Jiye_Park 13:07:52 topic: Minutes 13:08:04 -> https://www.w3.org/2022/11/28-wot-sec-minutes.html Nov-28 13:08:40 scribenick: Jiye 13:08:52 approved 13:08:56 topic: Schedule 13:09:23 mm: until end of this year, we will have one more meeting 13:09:36 i|until|-> https://www.w3.org/WoT/IG/wiki/Main_WoT_WebConf#Cancellations_and_Schedule_Updates Cancellations on the main wiki| 13:09:49 ...: next week meeting will be canceled and then week after, we will have a meeting 13:10:49 s/...:/... 13:14:22 present+ Jan_Romann, Tomoaki_Mizushima 13:14:30 topic: wide review 13:15:09 -> https://github.com/w3c/transitions/issues/474#issuecomment-1326375790 13:16:52 mm: TAG review is closed and security review is close which is add 13:16:58 s/add/odd/ 13:18:13 s/TAG review is closed and security review is close which is odd/ TAG review is closed and security review is still opened which is odd/ 13:19:15 Mizushima has joined #wot-sec 13:19:24 (writing an email to Daniel) 13:20:03 ... I am not sure who is responsible for security review and Sam didn't response 13:20:15 topic: implementation reports 13:22:21 s/5790/5790 transitions issue 474 - CR Request for Web of Things (WoT) Architecture 1.1/ 13:22:52 rrsagent, make log public 13:22:56 rrsagent, draft minutes 13:22:56 I have made the request to generate https://www.w3.org/2022/12/05-wot-sec-minutes.html kaz 13:26:03 mm: there are few gaps about certain security schemes 13:26:41 ... one is the body security location using json pointers which no one is use that 13:27:39 i|there are|-> https://w3c.github.io/wot-thing-description/testing/report11.html TD 1.1 Implementation Report| 13:30:39 * 95: sec-body-name-json-pointer 13:30:41 * 97: sec-body-name-json-pointer-array 13:30:57 * 100: td-security-in-uri-variable 13:31:10 * 102: td-security-uri-variables-distinct 13:35:17 jy: I have asked if there is any update regarding security schemes on Siemens side, and there is no big update. The question is do we really need security schemes in the body? 13:35:39 ... there is no difference on security strength if we use TLS/DTLS 13:36:32 mm: it's about API support. I can implement this part in Java or Python 13:37:06 ... for instance, philips hue add security key into URI 13:37:16 jy: but this is not secure 13:37:22 mm: agree but that's how they do 13:38:26 ... we need to find an example of using security scheme in the body using JSON pointer and refer to it 13:40:02 see also https://github.com/w3c/wot-profile/pull/331 13:40:18 s/see also/->/ 13:40:37 s/331 See also: wot-profile PR 331 - narrowing down oauth required flows/ 13:40:41 mm: seems we don't have client side implementation. only client flow is at risk 13:40:41 rrsagent, draft minutes 13:40:41 I have made the request to generate https://www.w3.org/2022/12/05-wot-sec-minutes.html kaz 13:41:11 ... we also have device flow at risk but it's more like device onboarding than authenticating 13:41:25 * 131: td-security-oauth2-client-flow 13:41:26 * 132: td-security-oauth2-client-flow-no-auth 13:41:33 * 133: td-security-oauth2-device-flow 13:41:35 ... I more concern about the client implementation 13:41:57 ... probably we need to work on the client side implementation 13:43:30 * 232: td-security-extension 13:44:41 mm: some of the examples are old. we need another example that someone is using the extension. we have to invent a scenario which needs extension, this is kinda weird one 13:46:33 mm: table is sorted number 282 downward, security, privacy are groupped 13:48:09 topic: scanning security implementation for discovery 13:48:21 * 33?: security-bootstrapping-endpoints 13:48:31 s/33?/33/ 13:48:54 mm: this is simple to handle, we just need to add an assertion. 13:49:17 * 34:exploration-secboot-401 13:49:36 mm: this is also related to bootstrapping and it's invisible 13:49:58 jan: there is an implementation pending having this feature 13:51:07 mm: note that number 33 - 36 are security related 13:52:14 ... 137-144 resonable to have it. 13:53:34 * 142: sec-tdd-intro-if-multicast-required 13:55:28 topic: scanning security implementation for architecture 13:57:45 mm: most of the things will be not at risk if there is one more implementation 14:00:16 jan: there is no DTLS 1.3 implementation 14:01:15 mm: number 51, there is a bit of ambiguous 14:01:37 jy: yes, it doesn't need to be now, but it's better to change from MAY to MUST eventually 14:01:59 kaz: it wouldn't change implementation requirements. right? 14:02:00 topic: AOB 14:02:07 i/AOB/mm: right/ 14:02:45 https://github.com/w3c/wot-architecture/issues/885 14:02:45 topic: AOB 14:02:47 (none) 14:03:07 [adjourned] 14:03:40 rrsagent, draft minutes 14:03:40 I have made the request to generate https://www.w3.org/2022/12/05-wot-sec-minutes.html kaz 15:23:20 Zakim has left #wot-sec