00:48:22 RRSAgent has joined #wpwg 00:48:26 logging to https://www.w3.org/2025/11/11-wpwg-irc 00:48:27 Scribe: Ian 00:48:27 takashi has joined #wpwg 00:48:35 RRSagent, this meeting spans midnight 00:50:59 DP has joined #wpwg 00:50:59 jcayzac has joined #wpwg 00:50:59 present+ 00:51:00 Rene has joined #wpwg 00:51:02 present+ 00:51:03 present+ 00:51:05 present+ 00:51:07 Jonathan has joined #wpwg 00:51:08 timcappalli has joined #wpwg 00:51:11 nakjo has joined #wpwg 00:51:11 raginpirate has joined #wpwg 00:51:12 sidvishnoi has joined #wpwg 00:51:13 present+ 00:51:14 Gerhard has joined #WPWG 00:51:14 willmorgan has joined #wpwg 00:51:15 lychee has joined #wpwg 00:51:15 present+ 00:51:16 vasilii has joined #wpwg 00:51:21 present+ 00:51:21 martin_alvarez has joined #wpwg 00:51:23 present+ 00:51:33 present+ 00:51:41 present+ 00:51:42 Vanitha has joined #wpwg 00:51:42 present+ 00:51:42 shuji has joined #wpwg 00:51:42 present+ 00:51:42 Keith has joined #wpwg 00:51:44 Roger has joined #wpwg 00:51:45 Kavya has joined #wpwg 00:51:46 Jason has joined #wpwg 00:52:03 tomasz has joined #wpwg 00:52:36 Present+ 00:52:50 SameerT has joined #wpwg 00:52:58 present+ 00:53:08 fahadMastercard has joined #wpwg 00:53:17 present+ 00:53:46 takashi has joined #wpwg 00:54:02 present+ 00:54:14 Topic: Payment Request 00:55:34 Ian: Any Payment Request implementation or adoption updates 00:56:03 Ian: How has it been using PR API to get to ApplePay ? 00:56:21 Nick_S: Good! We have soft deprecated ApplePay.js. We are no longer adding new features to it. 00:56:24 takashi9 has joined #wpwg 00:56:25 HeatherF has joined #wpwg 00:56:32 Albert has joined #wpwg 00:56:40 ...one example is that we now support disbursements. We are only adding support to PR API and not the proprietary API 00:56:48 ...I expect over the next year we will start to further deprecate it. 00:56:57 plh has joined #wpwg 00:57:02 ...we support ApplePay on other browsers through a polypill. 00:57:11 q+ 00:57:12 ...we like payment request and think it's good 00:57:24 ack smcgruer_[EST] 00:57:44 benoit has joined #wpwg 00:57:48 present+ 00:57:57 smcgruer_[EST]: If I understand, the ApplePay experience onChrome on MacOS is a QR code. Any desire to use PH API? 00:57:58 steele has joined #wpwg 00:58:01 nick_S: We are interested. 00:58:05 present+ 00:58:23 Anna has joined #wpwg 00:58:34 Nick_S: At least some of my colleagues. We may also have an opportunity with digital credentials to take a more generic approach. 00:58:42 taki has joined #wpwg 00:59:11 Nick_S: Apple pay is also supported some some headless devices; we are interested in exploring handoff options. 00:59:47 smcgruer_[EST]: From our side, we shipped native payment handlers for web views. If a web view host opts in, to enable the user of payment handler API 00:59:50 Padmanabhan has joined #wpwg 01:00:37 ioana has joined #WPwg 01:00:37 Cathy (Meta): In the Facebook browser we can now support PR; experiment was wildly positive. Conversions increased a good amount. 01:01:17 mt_hates_irc has joined #wpwg 01:01:33 ...you click on a link in the Facebook app, and payment request can be used instead of a JS implementation 01:01:47 ...seeing Google Pay without PR API took a minute to log in...it was not a good UX 01:01:55 ...but with PR API, checkout happened within 20 seconds. 01:02:14 smcgruer_[EST]: This is using the open payment handler stack; this would work with any payment handler 01:03:09 alexs has joined #wpwg 01:03:10 Ian: Any PH API news? 01:03:11 q+ 01:03:11 present+ 01:03:16 agektmr4 has joined #wpwg 01:03:25 smcgruer_[EST]: Shopify sought input PH API in interop 2026 01:03:56 smcgruer_[EST]: Interop 202X is an open submission where anyone can submit what they consider to be an interop issue on the Web 01:04:13 ...this effort has been, IMO, amazingly successful 01:04:28 Jorge has joined #WPWG 01:04:32 ...we've seen interop scores go up across browsers. 01:04:38 ..there is a proposal process. 01:05:14 NickTR: Who hosts this? 01:05:26 Martin_Thompson: This is under "Web Platform Tests" auspices. 01:05:30 https://wpt.fyi/interop-2025 01:05:57 Martin_Thompson: The goal is to get close to 100% agreement across tests. 01:06:15 ...if something like this (PH API) makes it, it will improve interoperability 01:06:43 ack heath 01:06:46 q+ 01:07:15 present+ 01:07:18 present+ 01:07:20 ack lychee 01:07:26 present+ 01:07:26 gkok has joined #wpwg 01:07:37 present+ 01:07:45 yigu has joined #wpwg 01:07:47 Ehsan has joined #wpwg 01:07:50 s/Thompson/Thomson/ 01:07:57 Cathy: The original question was about "payment handlers": what we found for PR API, sometimes when a PH exists, sometimes it's blocked. We had to get on an allow list. 01:08:15 ...if you are a payment handler and you're not on our allow list, talk to me. 01:08:22 smcgruer_[EST]: That's a choice of the app distributor 01:08:27 q? 01:08:42 NickTR: Those are native apps. 01:08:45 ack G 01:09:19 Gerhard: I'm excited to hear about interop (2026). I've heard people say "Come back to me when browser X supports this"; it seems like a way to motivate interoperability. 01:09:26 https://wpt.fyi/interop-2025 01:09:54 https://web.dev/blog/interop-2026-proposals 01:10:02 Gerhard: Do we have timelines? 01:10:02 https://github.com/web-platform-tests/interop/blob/main/2026/selection-process.md 01:10:33 rbyers: This is not a mechanism to get someone to do something they don't want to do. It's a means to get signals; vendors make their own decisions. 01:10:41 smcgruer_[EST]: But it is a good venue to indicate interest. 01:11:16 rbyers: Look for news (blog post) later this year. 01:11:52 PLH: Mike Smith is our link to WPT and interop 01:11:54 tomasz has joined #wpwg 01:12:45 [WPT finds its origin at TPAC 2009: https://www.w3.org/2009/11/TPAC/DevMeeting] 01:13:05 agektmr_ has joined #wpwg 01:13:10 https://github.com/web-platform-tests/interop/issues lists the open proposals 01:13:21 agektmr4 has left #wpwg 01:13:44 -> https://github.com/w3c/payment-request/issues/1040 Improved error codes 01:13:59 smcgruer_[EST]: The request for improved error codes (from PayPal) 01:14:08 steele has joined #wpwg 01:14:17 ...my recollection is that there might be some privacy concerns; I don't think so. 01:14:30 ...but we need to make sure it does not break things in an implementation. 01:15:20 nickTR: There are two proposed directions (1) feature detection (2) specific error code 01:15:29 Sami has joined #wpwg 01:15:44 ...my sense was that Marcos' suggestion had less potential to be a breaking change 01:16:05 armanaygen has joined #WPWG 01:16:21 smcgruer_[EST]: At first glance, I lean towards Marcos' approach. 01:17:33 Ian: Any TAG perspectives here? 01:18:04 Martin: Under normal circumstances, adding error codes is an ok thing to do; people should expect that understanding evolves. 01:18:27 ...but also, software will typically break. 01:18:38 ...respond to the screaming that you will hear 01:18:41 q? 01:19:05 Sami has joined #wpwg 01:19:48 Action: smcgruer_[EST] to sync up with Marcos to try to sync up on 1040. 01:20:13 Takashi has joined #wpwg 01:20:38 Ian: Any opportunity to connect PR API to new digital wallets? 01:20:40 Nick_S: Yes. 01:20:40 q+ 01:21:10 ...as I mentioned yesterday, DC API will allow any credential manager to plug into it 01:21:10 fahadMastercard has joined #wpwg 01:21:12 ...those implementations are shipping 01:21:39 ...it seems like there's an opportunity to combine the many years of work we put into PR API to handle complex checkout flows (e.g., price negotiation based on contact info) 01:21:39 q- 01:21:46 ...with this extensible system for credentials. 01:22:07 ...it would be very unfortunate if we ended up in a place where there was use of DC API for payments 01:22:09 jcayzac has joined #wpwg 01:22:23 ...we should schedule some time in the future to see how we can bring these two APIs together in a combined flow. 01:22:23 q+ 01:22:25 q? 01:22:30 ack Gerhar 01:22:38 q+ 01:22:39 q+ 01:22:50 Gerhard: Are we proposing that a Payment Request do its thing then invoke DC API? 01:23:07 nick_S: That's one option, but I am thinking that DC API might be a standardized payment method that can be used within PR API 01:23:13 q+ 01:23:14 ...there may well be other things we want to do 01:23:15 q+ 01:23:21 ...e..g., auxiliary claims could fit into that flow 01:23:37 ...a good example might be phone number. PR API allows you to query phone number. 01:23:55 ...so you may want to get a payment credential and a phone credentail; you may need an API that allows you to get multiple credentials. 01:24:03 ...this would allow you to fall back gracefully. 01:24:15 ...suppose a wallet supports digital credentials and can return a 3DS cryptogram 01:24:36 ...if you are on an older browser, you could say "I also support these other payment methods" and have graceful fallback 01:24:49 ack tomasz 01:24:52 tomasz: I think this is an interesting idea, especially since PR API has a lot of support for payment use cases. 01:25:07 ...what DC API is lacking these days is to provide a structured context for payments, which we have (more or less) in PR API 01:25:20 q- 01:25:22 willmorgan has joined #wpwg 01:25:24 ...the way we think about digital credentials goes beyond web 01:25:29 ...PR API is just for the web. 01:25:33 q? 01:25:38 ...the platforms have implemented their APIs natively 01:26:17 nick_S: The DC API is also a web standard. I'm not saying you wouldn't have native integrations, it's more that we want web sites to have access. 01:26:19 ack timcappalli 01:26:45 timcappalli: We need to chat sooner rather than later about what this would look like for developers. 01:26:57 ...e.g., simple use case for PR API, more sophisticated UX with DC API 01:27:05 armanayg_ has joined #WPWG 01:27:19 Sean has joined #wpwg 01:27:19 ...the original idea with DC API was to have a type attached to the request; but that's been offloaded to the protocol 01:27:20 ack mt_hates_irc 01:27:28 timcappalli has joined #wpwg 01:27:54 MartinT: One of the things that's interesting here is that there's pushback on use of DC API for privacy reasons. The TAG does not want to see people refusing to do business unless they get access to identity information 01:28:11 ...the considerations that apply on the DC side will apply even more in payments. 01:28:16 q+ 01:28:30 ack nick 01:28:34 q+ 01:28:46 nickTR: Nick_S made an interesting point about digital credentials as a payment method. 01:29:14 ...but my instinct would be that PR API provides context, and DC API would be an extension point to respond to a payment request. 01:29:59 q? 01:29:59 timcappalli: Think of DC as a format. 01:30:09 q+ 01:30:28 q+ 01:30:32 timcappalli: DC API is the entry point for the developer. After that there's plumbing that can hold credentials. 01:30:54 lychee has joined #wpwg 01:31:01 q+ 01:31:10 nickTR: I share the TAG's concerns generally about barriers that are presented by doing identity 01:31:30 ...but age verification is often required in a regulatory environment. 01:31:39 q? 01:31:49 q+ 01:32:07 q- 01:32:18 ack rbyers 01:32:31 rbyers: This is an interesting discussion discussion about PR API and DC API 01:32:44 ...it was core to design of DC API that it be one-shot (not bi-directional) 01:32:56 ...so we'd have to do some work to understand how they relate 01:33:16 ...PR API does not require a user interaction in the same way DC API does 01:33:21 q? 01:33:24 ack fahadMastercard 01:33:50 fahadMastercard: I think connecting these is a good idea. I think we need to solve for the .create use case for payments 01:33:50 q? 01:33:54 zakim, close the queue 01:33:54 ok, Ian, the speaker queue is closed 01:34:05 ack tomasz 01:34:16 Ash has joined #WPWG 01:34:25 tomasz: Regarding digital credential-as-payment method... I would think we'd need the type of credential as a payment method 01:34:29 q? 01:34:43 q+ 01:34:51 ack nick_s 01:35:02 vasilii has joined #wpwg 01:35:33 nick_S: I think merchants often want all the buttons visible.... 01:35:38 +1 01:35:59 ...NickTR's Finland example is a good example of where we should be using DC API....selective disclosure should be done with DC API 01:36:09 +1 01:36:10 ...I look forward to continuing the conversation 01:36:16 q? 01:36:22 @tomasz that's the point that I was trying (inelegantly) to make - payment methods represent a more granular request for a specific kind of credential 01:36:45 Velvizhi has joined #wpwg 01:37:03 Topic: Facilitated payment links 01:41:31 (smcgruer_[EST] presents slides) 01:41:58 smcgruer_[EST]: Browser can ignore the payment links flow; the merchant still needs a backup flow (e.g, QR code) 01:43:14 Shipping in Chrome since July 2025 01:43:22 ...There are 7 wallets supported by chrome 01:43:42 ...our page loads are increasing rapidly 01:44:11 ...there's a lot of demand for this for non-EU / North Am markets 01:44:36 (We see demos) 01:46:16 q? 01:46:55 q+ 01:47:04 zakim, open the queue 01:47:04 ok, nicktr, the speaker queue is open 01:47:08 q+ gkok 01:49:10 q? 01:50:31 Yasu4 has joined #wpwg 01:50:42 timcappalli has joined #wpwg 01:51:44 taki has joined #wpwg 01:52:50 nick_s has joined #wpwg 01:52:56 Lee: Do we need (yet another) API to go from Web to native app? 01:54:00 nina has joined #wpwg 01:54:24 q+ 01:54:40 vasilii has joined #wpwg 01:55:25 timcappalli has joined #wpwg 01:55:41 smcgruer_[EST]: Why a new front end? We are hearing from merchants they won't build a JS integration. They are saying no to PR API. They are willing to drop an HTML link on their page. 01:56:10 ...we cannot solve for generic payment protocols today ; nowhere to host manifest so we went with intents for the moment 01:56:46 q- 01:56:49 Marcos: At a high level, the use case is interesting. 01:56:59 ...but I question some of the design decisions. 01:57:31 ...why do you need a link relationship to duplicate data (for the QR use case) 01:57:37 ...why not just label the image? 01:57:41 smcgruer_[EST]: That makes sense. 01:58:40 nakjo has joined #wpwg 01:59:08 Martin: I'm concerned about resolution of these URLs 01:59:13 ...you have data URLs in there potentially loading UI which could be an attack vector 01:59:26 ...in the DC API we wrote up why custom URI schemes is not a good idea 01:59:39 smcgruer_[EST]: Do you have a suggestion for doing this declaratively in a way that would be good? 01:59:47 ...we heard one idea to use data URLs 02:00:07 Martin: The Web site uses a custom scheme that the browser recognizes, and the browser knows how to turn those things into a payment request (to a first approximation) 02:00:11 ...that's a resolution process. 02:00:18 ..you are not specifying a resolution process here. 02:00:33 ...if these were HTTPs URLs, they would be interoperable 02:00:54 smcgruer_[EST]: For the ones that are entity-specific, yes, we should fix custom scheme issue 02:01:11 ...but for a generic protocol that anyone can answer, how do you solve the decentralized use case? 02:01:36 timcappalli has joined #wpwg 02:01:37 The doc Marcos referenced: https://github.com/w3c-fedid/digital-credentials/blob/main/custom-schemes.md 02:02:10 Martin: Don't make the browser know how to handle proprietary schemes. 02:02:31 ...different browsers might have different understandings, and we'd not get interop 02:02:51 ...you'd get an inconsistent user experience 02:03:09 tomasz has joined #wpwg 02:05:19 q? 02:06:09 Idea: Map this to PR API if possible 02:06:26 vasilii has joined #wpwg 02:07:01 I have made the request to generate https://www.w3.org/2025/11/11-wpwg-minutes.html nicktr 02:08:29 benoit_ has joined #wpwg 02:23:15 armanaygen has joined #WPWG 02:26:59 topic: Payments in Japan 02:27:13 Note: The first presentation from Morimori will remain Member visible upon his request. 02:27:18 vasilii has joined #wpwg 02:33:49 nick_s has joined #wpwg 02:35:07 DP has joined #wpwg 02:36:02 Morimori: I want to cover three topics today - phishing resistant MFA in japan; selfi-matching only eKYC is being obsoleted 02:36:06 timcappalli has joined #wpwg 02:36:07 ....Digital identity guidelines 02:36:11 taki has joined #wpwg 02:36:37 armanaygen has joined #WPWG 02:38:54 [Scribe will cover discussion but not the slides] 02:38:57 q? 02:39:00 ack gk 02:40:19 ann has joined #wpwg 02:40:21 ioana has joined #wpwg 02:40:29 Shuji has joined #wpwg 02:41:32 gkok has joined #wpwg 02:41:57 benoit__ has joined #wpwg 02:42:13 elkurin has joined #wpwg 02:42:14 q? 02:42:15 q+ 02:42:21 ack gkok 02:42:29 ack gkok 02:42:39 Gustavo: You mentioned the focus is on financial services. Is there more strict guidance possible as well to providers? 02:43:58 Morimori: Countermeasures from the government is to implement DMARC with reject as well as phishing resistant MFA. It's not mandated, for all parties, but other parties are following suite. 02:44:00 s/suite/suit 02:44:22 q+ 02:44:22 Gustavo: Customers may not understand why it's important to use passkeys. What is happening to educate users? 02:44:33 Morimori: Good question; I will need to think more about that. 02:44:43 q- 02:45:04 Cip: For payments authentication, is phishing resistant MFA going to happen? 02:45:04 nakjo has joined #wpwg 02:45:06 Morimori: More on that in a moment 02:47:30 Morimori: Regarding identity proofing, ... there has been traditional eKYC (selfie matching only) 02:47:30 ...but companies are seeing lots of attacks through fake ID cards. 02:47:44 ...so the trend in Japan is to use IC Chip-equipped id cards 02:47:44 ...so the goal is to obsolete sell-matching only eKYC 02:54:48 (in 2024-2025) 02:54:52 JPKI and its capabilities on a smartphone 02:54:52 ....MyNumber Card on iPhone became available in June 2026 02:54:52 s/2026/2025 02:54:52 "d payment" application allows to do identity proofing 02:54:52 Morimomri: Digital Agency recently published the DS-511 digital identity guidelines 02:54:52 ...is a normative requirement as of 30 September 2025 02:54:52 ...there are three authentication levels 02:54:52 ...the user must be able to choose phishing resistant MFA (with passkeys as an option) 02:54:52 q 02:54:52 q+ 02:54:52 ack Ger 02:54:52 Gerhard: Thank you for the presentation. In Europe we've seen definitions for SCA that may not align exactly with the implementation of passkeys. 02:54:52 ..e.g., one example we've spoken about is device binding 02:54:52 ...can you say more how Japan has defined MFA, and are there specifics (e.g., key lengths, device binding) 02:54:52 Morimori: DS-511 defines normative guidelines. 02:54:52 ....but there will be supplemental guidelines that explain what phishing resistance means 02:54:58 Gerhard: Will it be device-bound? 02:54:58 willmorgan has joined #wpwg 02:54:58 Morimori: Synched passkeys were a controversial discussion 02:54:58 ...personally I think synched passkeys really help 03:06:26 RRSAgent has joined #wpwg 03:06:28 logging to https://www.w3.org/2025/11/11-wpwg-irc 03:08:14 NickTR -- note that RRSAgent dropped at 21:54:46. (I've invited the bot back.) Some IRC loc and/or minutes patching will be needed. (I don't know who your staff contact is. They can help.) 03:08:22 ...open banking in API 03:08:59 [11:55] Morimori: With my NTTDoCoMo hat on I am driving to implement passkeys with 3DS 03:08:59 [11:55] q? 03:08:59 [11:55] * Zakim sees no one on the speaker queue 03:08:59 [11:55] Cip: As of April 2025 there are also other rules in Japan. 03:09:00 [11:56] [Takashi Minamii from JCB] 03:09:01 [11:56] TM: JCB covers Amex and Discover in Japan 03:09:02 [11:57] ...the Japan payment landscape is complex. 03:09:04 [11:58] ...JCB is trying to implement digital wallet with selective disclosure 03:09:06 [11:59] ...in Japan, Credit card remains the primary payment method 03:09:08 [11:59] ...QR code payments have grown significantly 03:09:12 [11:59] * nina (~nina@6b13c2d6.publics.cloak) has joined #wpwg 03:09:14 [11:59] ...mostly for public transportation payments 03:09:16 [12:00] ...but combined share of e-money and QR code payments is approaching 50% on a transaction count basis 03:09:19 [12:00] ...heavily skewed to small-value payments 03:09:21 [12:01] [Slide on merchant discount rate] 03:09:23 [12:01] TM: There are no caps on MDR or IRF 03:09:25 [12:01] * nick_s has quit ("My Mac has gone to sleep. ZZZzzz…") 03:09:27 [12:02] * nick_s (~textual@6c65f1b9.public.cloak) has joined #wpwg 03:09:29 [12:03] ...in Japan, two companies handle card processing: CAFIS and CARDNET 03:09:31 [12:03] * Albert (~Albert@6b13c2d6.publics.cloak) has joined #wpwg 03:09:33 [12:05] * taki has quit () 03:09:35 [12:05] ...IPR overlap: "Cotra" exists, but only for P2P remittance 03:09:37 [12:06] ...Confirmation of Payee is so ubiquitous that Japanese people don't even think about it 03:09:39 [12:06] * RRSAgent (rrsagent@16081354.team.cloak) has joined #wpwg 03:09:43 [12:06] logging to https://www.w3.org/2025/11/11-wpwg-irc 03:09:45 [12:08] NickTR -- note that RRSAgent dropped at 21:54:46. (I've invited the bot back.) Some IRC loc and/or minutes patching will be needed. (I don't know who your staff contact is. They can help.) 03:09:48 [12:08] ...open banking in API 03:09:50 TM: Alternatives to write-access APIs - real time direct debiting service 03:13:28 TM: Stable coin and CBDC 03:16:06 q? 03:16:22