13:49:47 RRSAgent has joined #wpwg 13:49:51 logging to https://www.w3.org/2026/05/21-wpwg-irc 13:50:07 Meeting: Web Payments Working Group 13:50:22 Agenda: https://github.com/w3c/webpayments/wiki/Agenda-20260521 13:50:28 Chair: Ian 13:50:30 Scribe: Ian 13:56:09 sidvishnoi has joined #wpwg 13:57:01 agenda+ BBK clarifications 13:57:05 agenda+ Roaming authenticators 13:57:12 agenda+ Currency code topic 13:57:43 agenda+ Reminder of ECommerce/AI workshop (8-9 September in Zurich) 13:57:52 agenda+ Upcoming schedule 13:59:19 I have made the request to generate https://www.w3.org/2026/05/21-wpwg-minutes.html Ian 14:00:03 present+ Sid_Vishnoi 14:00:07 present+ Ian_Jacobs 14:00:30 present+ Takashi_Minamii 14:00:35 present+ Jean-Luc_di_Manno 14:00:38 present+ Steve_Cole 14:00:54 JL has joined #WPWG 14:00:56 Takashi has joined #wpwg 14:01:26 present+ Sami_Tikkala 14:01:28 benoit has joined #wpwg 14:01:51 present+ 14:01:51 present+ Darwing_Yang 14:01:54 present+ David_Benoit 14:01:58 darwin has joined #wpwg 14:01:58 present+ Joan_Earnshaw 14:02:03 present+ John_Earnshaw 14:02:07 present- Joan_Earnshaw 14:02:12 present+ Bjorn_Hjelm 14:02:18 present+ Garima_Jaiswal 14:02:33 present+ Ryan_Watkins 14:02:57 present+ Bharat 14:03:08 present+ Kenneth_Diaz 14:04:09 present+ Stephen_McGruer 14:04:51 zakim, take up item 1 14:04:51 agendum 1 -- BBK clarifications -- taken up [from Ian] 14:05:12 https://github.com/w3c/secure-payment-confirmation/issues/321#issuecomment-4374638224 14:05:43 present+ Ehsan 14:06:26 Ehsan has joined #wpwg 14:08:09 (Ian reviews the proposal) 14:08:21 John: I think that works well and clears up ambiguities we noted. 14:08:55 ...my only question is where we have a 1-1-1 relationship between browser/passkey/device, there is still a situation where the same "tuple" with multiple BBKs. 14:09:06 ...because of different logins on the browser. 14:09:25 ...in case of multiple profiles. 14:09:57 Ian: How does this approach interact with current implementation? 14:10:20 Darwin: Regarding profiles, there's probably a still gap where the installed browser program would mean "same bbk across profiles." 14:10:44 Stephen: I am hearing you can't say "1-1-1" because of profiles. 14:10:49 present+ Albert_Schibani 14:11:35 Stephen: For Chrome in particular a user with a single installation of Chrome could have 2 profiles, each of which would have a different BBK. 14:11:53 present+ Dan_Pelegero 14:12:28 Stephen: An installed browser program can have multiple BBKs for a given passkey, but different installed programs are guaranteed to have different BBKs for this same passkey 14:12:43 present+ Gerhard_Oosthuizan 14:12:47 present+ Gerhard_Oosthuizen 14:12:50 present- Gerhard_Oosthuizan 14:13:58 Stephen: We should say in reqs do that the important statement is that a single BBK is not reused for any of (1) different installed browser programs on a device (2) different devices for the same or different installed browser program and (3) different passkeys 14:14:23 John: Another way of saying it: for each BBK there will be at most one installed browser program, passkey, and device. 14:14:33 ...the important bit is that the BBK implies the tuple. 14:14:52 A specific BBK ==> (1 browser installed program, 1 device, 1 passkey), but that relationship doesn't go in the other direction 14:14:54 ..the BBK enforces the tuple but the tuple does not necessarily enforce the BBK. 14:15:50 q? 14:16:08 Action: John_Earnshaw to do a pull request on BBK requirements doc to (1) introduce installed browser program and (2) describe the tuple relationship more clearly. 14:16:45 Stephen: We are likely to want to be explicit in the spec but let's do that after the reqs document. 14:17:34 rrsagent, make minutes 14:17:35 I have made the request to generate https://www.w3.org/2026/05/21-wpwg-minutes.html Ian 14:17:41 zakim, close item 1 14:17:41 agendum 1, BBK clarifications, closed 14:17:41 I see 4 items remaining on the agenda; the next one is 14:17:41 2. Roaming authenticators [from Ian] 14:17:41 zakim, take up item 2 14:17:41 agendum 2 -- Roaming authenticators -- taken up [from Ian] 14:18:13 -> https://github.com/w3c/secure-payment-confirmation/issues/12#issuecomment-4509002452 Bjorn requirements list 14:18:17 slobodan has joined #wpwg 14:19:11 SPC SHALL follow the WebAuthn flow for discovering authenticators and identifying the correct authenticator to be used. 14:19:11 The roaming authenticator SHALL be paired with an application or through a FIDO credential registration. 14:19:11 Persistent CTAP PUAT (pinUvAuthToken) SHALL be supported and the discoverable credential(s) on the roaming authenticator SHALL be cached. 14:19:12 SPC SHALL support providing a filtered list of eligible credentials. 14:19:12 SPC SHALL support cross-origin/payment credential flag (in SPC and CTAP). 14:19:25 ---- 14:21:40 Bjorn: There is some complexity. But one expectation is whether the device is plugged in. 14:22:03 ...these requirements don't address situation where roaming authenticators is not plugged in then plugged in. 14:22:15 ...there may also be slight variations among platforms. 14:23:00 ...a roaming authenticator could be any device that acts as a roaming authenticator (e.g., the hybrid use cases as an example) 14:23:10 ...or even a credit card that acts as a fido authenticator. 14:23:50 ...to fully explore I assume we'd have to create a requirements document. 14:24:25 Ian: What does "filtered list of eligible credentials" refer to? 14:24:43 Bjorn? There might be different credentials that could be used for different purposes. 14:25:21 Bjorn: There might be different credentials that could be used for different purposes. 14:26:06 Ian: That feels like a new functionality (for any authenticator) 14:26:53 Ian: "SHALL be paired with an application or through a FIDO credential registration." 14:28:55 Bjorn: The credential on the roaming authenticator is discovered; you have to onboard the credential from the roaming authenticator. 14:28:59 present+ Jeff_Owenson 14:29:07 present+ Sue_Koomen 14:29:50 zakim, close item 2 14:29:50 agendum 2, Roaming authenticators, closed 14:29:51 I see 3 items remaining on the agenda; the next one is 14:29:51 3. Currency code topic [from Ian] 14:29:55 zakim, take up item 3 14:29:55 agendum 3 -- Currency code topic -- taken up [from Ian] 14:30:14 https://github.com/WICG/webmonetization/issues/440#issuecomment-4252501984 14:30:52 Sid: ISO 24165 - Digital token identifier (DTI) appears be the future standard for digital currencies from ISO. 14:30:59 https://www.iso.org/standard/85546.html 14:31:14 Sid: Unlike the 3-letter ISO 4217 codes, DTIs use 9-letter alphanumeric codes (e.g. 4H95J0R2X for Bitcoin, L6GTZC9G4 for Ripple, and ZNWVNRMHK for USDC Eth). I'm not sure whether these registrations are official, or how was the community interest towards adoption of this standard (given there are so many alternative standards in crypto community), but this should give us some direction. 14:31:20 Sid: I've not seen evidence that these are used public. 14:31:24 s/public/publicly 14:32:10 Sid: until there's public demand (from wallets) e.g., in Payment Request, we can put this topic on the back burner 14:33:21 zakim, close item 3 14:33:21 agendum 3, Currency code topic, closed 14:33:22 I see 2 items remaining on the agenda; the next one is 14:33:22 4. Reminder of ECommerce/AI workshop (8-9 September in Zurich) [from Ian] 14:33:30 zakim, take up item 4 14:33:30 agendum 4 -- Reminder of ECommerce/AI workshop (8-9 September in Zurich) -- taken up [from Ian] 14:33:39 https://github.com/w3c/strategy/issues/544 14:33:56 September 8 and 9 2026 in Zurich. 14:37:16 (Ian gives background on workshop, relationship to this WG's agenda) 14:37:20 zakim, close item 4 14:37:20 agendum 4, Reminder of ECommerce/AI workshop (8-9 September in Zurich), closed 14:37:22 I see 1 item remaining on the agenda: 14:37:22 5. Upcoming schedule [from Ian] 14:37:25 zakim, take up item 5 14:37:25 agendum 5 -- Upcoming schedule -- taken up [from Ian] 14:38:22 4 June 14:39:01 sidvishnoi has left #wpwg 14:39:42 Ian: I propose 1-day WG meeting on Thursday at TPAC 14:39:46 ...and 2-day for IG on M/T 14:39:50 No strong reaction, unfortunately in my head far too far ahead of TPAC to know what agenda topics would be :D 14:40:42 No meeting on 18 June 14:40:49 I have made the request to generate https://www.w3.org/2026/05/21-wpwg-minutes.html Ian 14:40:55 RRSAGENT, set logs public 15:58:13 dlehn has joined #wpwg