13:53:24 RRSAgent has joined #wpwg 13:53:28 logging to https://www.w3.org/2026/07/16-wpwg-irc 13:53:32 Meeting: Web Payments Working Group 13:53:37 Meeting: https://github.com/w3c/webpayments/wiki/Agenda-20260716 13:53:40 Chair: Ian 13:53:42 Scribe: Ian 13:53:53 Meeting: Web Payments Working Group 13:53:58 Agenda: https://github.com/w3c/webpayments/wiki/Agenda-20260716 13:54:10 agenda+ Roaming authenticators and SPC 13:54:24 agenda+ Definition of third party in SPC 13:54:29 agenda+ Next meeting 14:01:22 present+ Rogerio_Matsui 14:01:26 present+ Steve_Cole 14:01:32 present+ Sami_Tikkala 14:01:40 present+ John_Earnshaw 14:01:48 present+ Kenneth_Diaz 14:01:55 agenda+ TPAC registration open 14:02:06 present+ Sue_Koomen 14:02:17 present+ Takashi_Minamii 14:02:35 present+ Tim_Cappalli 14:02:42 present+ Stephen_McGruer 14:02:43 present+ Isaiah_Inuwa 14:02:54 present+ Darwin_Yang 14:03:08 present+ Bjorn_Hjelm 14:03:08 Takashi has joined #wpwg 14:03:08 present+ Albert_Schibani 14:03:08 present+ David_Benoit 14:03:12 present+ 14:03:14 present+ Jean-Luc_di_Manno 14:03:19 present+ Ryan_Watkins 14:03:25 darwin has joined #wpwg 14:03:34 JL has joined #WPWG 14:03:34 agenda+ ECommerce/AI Workshop agenda 14:03:38 Sue has joined #WPWG 14:03:50 present+ Marie_Jordan 14:04:01 agenda? 14:04:26 present+ Sharanya 14:04:42 zakim, take up item 1 14:04:43 agendum 1 -- Roaming authenticators and SPC -- taken up [from Ian] 14:05:12 present+ Ehsan_Toreini 14:05:36 stephen: At a high level, when the group designed SPC, a core goal was to avoid "cannot proceed" states. 14:05:44 Ehsan has joined #wpwg 14:05:57 ...this is a known problem in WebAuthn land, where the user can't proceed with authentication but they are still staring at UX 14:06:34 ...this comes from two reasons (1) privacy model, which leads to always seeing some UX to avoid timing attacks, and (2) roaming authenticators that are available but not immediately 14:06:43 present+ David(Visa) 14:08:00 ...in SPC we endeavored to address this through two mechanisms: (1) silent query for authenticator existence is the first. 14:08:08 ...we thought this would exist due to capabilities like conditional UI. 14:08:20 ...but there are platforms where the browser cannot query for credential existence. 14:08:34 ...e.g., authenticators decline credman to do silent queries. 14:09:16 Albert has joined #wpwg 14:09:17 ...(2) a second ability was the ability to silently check if an credential is usable with SPC. But that info is in practice often stored in the browser. 14:09:40 ...so we find ourselves in a situation where roaming authenticators cannot be used with SPC as SPC is designed. 14:09:45 ...I have some ideas to address this. 14:10:31 ...approach one is to support roaming authenticators when its used and cache credentials. It's possible but not implemented today. 14:10:55 ...if we had such a cache, we could at both cache and any actually connected authenticators. 14:11:15 ...there are always issues with caches, of course. 14:11:53 ...a second approach would be to redesign SPC, but we'd have to accept then that we cannot avoid failure states. But that's already true today (which is why we have the fallback dialog) 14:12:00 ...so a proposal is: 14:12:38 1) To update the fallback dialog to allow the user to choose a passkey; an escape hatch for a user choice to use a phone or hardware key or some other authenticator 14:13:15 2) Give the web site the option of choosing an "optimized UX" v a "show the user UX " 14:13:39 ...for example there could be a boolean as input to express a preference 14:14:22 Tim_Cappalli: The idea of cached credentials was why we did "linked security keys"...but it's not really implemented. 14:14:46 ...we can't assume users will have hardware keys plugged in 14:14:57 Bjorn: +1 to Tim's comments 14:15:20 ...I agree with Stephen, having a safety valve sounds like a good approach 14:15:55 Stephen: We're not opposed to having a caching layer (though not a small feat). But it's not high on the priority list today on the implementation side. 14:16:56 Ian: Any thoughts from people on boolean variable? 14:17:01 s/implementation side/implementation side for our WebAuthn team; but they're happy for different parts of Chrome to implement it if they put the work in 14:17:17 Ryan: I think we would want to be able to say "we prefer immediately available authenticators" 14:18:02 present+ Garima_Jaiswal 14:18:46 Stephen: Cached credentials could be seen as same level (naively) as other immediately available authenticators. Any use cases where people would say "Never want a roaming authenticator" 14:19:47 q+ 14:19:56 Albert: How does this differ from immediate mediation? 14:20:01 ack st 14:20:25 Stephen: It would be a similar functionality (Immediate mediation is now called Immediate UI Mode) 14:20:48 ......but immediate mediation is somewhat controversial 14:21:05 ...immediate mediation in webauthn only works if you specify no credential ids; but that's the opposite with SPC. 14:21:18 ...that was to reduce probing ability. 14:21:35 present+ Isaiah_Inuwa 14:22:00 ...with immediate mediation the call fails when no credentials... 14:22:15 ...if we had a version of SPC without credential IDs, we may not be able to allow 3p use cases. 14:22:29 ack st 14:24:05 Tim_Cappalli: I'm working on a related proposal with a larger range of UI modes, but allow site to continue even when user does not choose an authenticator 14:24:44 Albert: I see an advantage of having several different UI modes if passkey is not immediately available. 14:25:38 Ian: Any other WebAuthn activities around this? 14:25:43 Tim: No, not really. 14:26:15 Stephen: I will likely create a markdown proposal and link to it from issue 12. 14:26:36 zakim, close item 1 14:26:36 agendum 1, Roaming authenticators and SPC, closed 14:26:37 I see 4 items remaining on the agenda; the next one is 14:26:37 2. Definition of third party in SPC [from Ian] 14:26:40 zakim, take up item 2 14:26:40 agendum 2 -- Definition of third party in SPC -- taken up [from Ian] 14:26:50 https://github.com/w3c/secure-payment-confirmation/issues/328 14:27:37 Stephen: Nina Satragno suggests we try to align with WebAuthn. 14:28:19 ...there is capability in WebAuthn to detect and ignore invalid subdomains. 14:28:24 iinuwa has joined #wpwg 14:30:20 Ian: Should a parent be able to use a credential of a subdomain? 14:30:34 DavidBenoit: TLD should be able to delegate which subdomain is the issuer for the TLD> 14:32:03 DavidBenoit: I want to be sure we don't introduce the possibility of some subdomain issuing tokens for a TLD without permission. 14:32:30 Ian: How complex to align SPC with WebAuthn? 14:32:55 Stephen: Should not be complicated. 14:33:02 ...I think that the code may already do this. 14:34:02 ...but not a high priority to do a pull request on the spec. 14:34:31 Ian: Let's record in the issue support for doing this and come back to it when people have more time. 14:34:34 zakim, close item 2 14:34:34 agendum 2, Definition of third party in SPC, closed 14:34:34 +1 14:34:35 I see 3 items remaining on the agenda; the next one is 14:34:35 3. Next meeting [from Ian] 14:34:39 zakim, take up item 4 14:34:39 agendum 4 -- TPAC registration open -- taken up [from Ian] 14:34:56 -> https://www.w3.org/register/tpac2026 TPAC registration 14:35:08 https://www.w3.org/calendar/tpac2026/ 14:36:15 EARLY BIRD FEE DEADLINE: 7 August. For more about registration fees, see: 14:36:15 https://www.w3.org/news-events/tpac/2026/registration 14:36:40 zakim, close item 4 14:36:40 agendum 4, TPAC registration open, closed 14:36:41 I see 2 items remaining on the agenda; the next one is 14:36:41 3. Next meeting [from Ian] 14:36:43 zakim, take up item 5 14:36:43 agendum 5 -- ECommerce/AI Workshop agenda -- taken up [from Ian] 14:36:50 https://www.w3.org/2026/ecommerce-agents/agenda.html 14:38:03 https://www.w3.org/2026/ecommerce-agents/cfp.html 14:38:27 zakim, close item 5 14:38:27 agendum 5, ECommerce/AI Workshop agenda, closed 14:38:29 I see 1 item remaining on the agenda: 14:38:29 3. Next meeting [from Ian] 14:38:32 zakim, take up item 3 14:38:32 agendum 3 -- Next meeting -- taken up [from Ian] 14:38:53 13 August 14:40:33 Topic: Can 3p bit be optional for third-parties? 14:40:44 Albert: What concerns are raised by making the 3p bit optional? 14:41:12 Stephen: I don't think it can be optional for 3p. We heard strongly at the time we created this that people could do association attacks. 14:42:00 ...if you don't have a 3p bit, then people could do SPC calls for other origins and it's implied that domainA is working with domainB, even if that's not true. 14:42:19 ...to continue discussion, it would be good to understand the underlying use case. 14:43:15 Ian: Remind me whether 1ps can use credentials without bits? 14:43:46 Stephen: In theory, yes. I think there are implementation bugs. I think it works in some contexts but bugs in some contexts. 14:44:21 ...let us know if people need this to be fixed. 14:45:02 RRSAGENT, make minutes 14:45:04 I have made the request to generate https://www.w3.org/2026/07/16-wpwg-minutes.html Ian 14:45:06 RRSAGENT, set logs public 15:45:06 TallTed has joined #wpwg