View source for IG Security WebConf/2022

Agendas from WoT Security TF in 2022

=== 19 December 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/12/05-wot-sec-minutes.html 5 December 2022]
* Next Charter
** https://github.com/w3c/wot/tree/main/proposals/deliverable-proposals
* Publications
** Updates to S&P Guidelines
** Aim to complete reviews and suggested changes (issues/PRs) by Jan 23.
* Testing
* Planning
** Next meeting 23 Jan 2023
* AOB

=== 5 December 2022 ===
Scribe: Jiye
* Minutes:
** [https://www.w3.org/2022/11/28-wot-sec-minutes.html 28 November 2022]
* Logistics
** [https://www.w3.org/WoT/IG/wiki/Main_WoT_WebConf#Cancellations_and_Schedule_Updates Schedule]
** Cancelled Dec 12 due to Testfest
** Last Meeting in 2022: Dec 19
** Cancelled Dec 26-Jan 9 (inclusive)
** First Meeting in 2023: Jan 16
* Publications - Wide Reviews
** https://github.com/w3c/transitions/issues/474
* Testing
* AOB

=== 28 November 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/11/21-wot-sec-minutes.html 21 November 2022]
* Publications - Wide Reviews
** https://github.com/w3c/transitions/issues/474#issuecomment-1326375790
* Testing
** Implementation Reports and Gaps
* Updates to S&P Guidelines doc
* AOB

=== 21 November 2022 ===
Scribe: 
* Minutes:
** [https://www.w3.org/2022/10/24-wot-sec-minutes.html 24 October 2022]
* Publications
** Architecture - "Trusted Environment" review
* Updates to S&P Guidelines doc
* Security Testing
** Testfest goal?
* AOB

=== 14 November 2022 ===
CANCELLED - McCool unavailable

=== 7 November 2022 ===
CANCELLED - McCool unavailable

=== 31 October 2022 ===
CANCELLED - Kaz unavailable

=== 24 October 2022 ===
Scribe: Jiye
* Minutes:
** [https://www.w3.org/2022/10/17-wot-sec-minutes.html 17 October 2022]
* Issues
** Implementation Reports
* PRs
* Planning
** Cancellations
** S&P Guidelines update
** Security Testing
* AOB

=== 17 October 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/10/10-wot-sec-minutes.html 10 October 2022]
* Issues
** Implementation Reports
* PRs
* Planning/Logistics
** McCool unavailable Nov 7-18.
* AOB

=== 10 October 2022 ===
Scribe: Jan
* Minutes:
** [https://www.w3.org/2022/09/26-wot-sec-minutes.html 26 September 2022]
* Issues
** Implementation Reports
*** Most issues still open have to do with security
*** [https://github.com/w3c/wot-architecture/pull/849 Architecture 1.1] [https://cdn.statically.io/gh/w3c/wot-architecture/7856f8b0b8534211f03273c44ecec6bfdc8935d0/testing/report11.html (rendered)]
*** [https://github.com/w3c/wot-thing-description/pull/1706 Thing Description 1.1] [https://cdn.statically.io/gh/w3c/wot-thing-description/f4a3b83faea870fcfba1b89a55f56fc6dffefbe2/testing/report11.html (rendered)]
*** [https://github.com/w3c/wot-discovery/pull/421 Discovery] [https://cdn.statically.io/gh/w3c/wot-discovery/daca95eefcb71a1cddda847eb1a824d3eb099e44/testing/report.html (rendered)]
*** [https://github.com/w3c/wot-profile/pull/298 Profile] [https://cdn.statically.io/gh/w3c/wot-profile/bc8ea7d704f4d7b3e187ec46f3f068c5311a03ff/testing/report.html (rendered)]
** Generally look at issues marked to the attention of Security TF in other repos
*** This on in TD repo was called out: https://github.com/w3c/wot-thing-description/issues/1670
* AOB

=== 3 October 2022 ===
CANCELLED - Plugfest

=== 26 September 2022 ===
Scribe: Philipp
* Minutes:
** [https://www.w3.org/2022/08/22-wot-sec-minutes.html 22 August 2022]
* Review issues
* Planning
** Publication
** Testing
* AOB

=== 22 August 2022 ===
Scribe: Jiye/Philipp
* Minutes:
** [https://www.w3.org/2022/08/08-wot-sec-minutes.html 8 August 2022]
* TAG Review
** Architecture S&P assertion review
* AOB

=== 8 August 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/08/01-wot-sec-minutes.html 1 August 2022]
* Wide Review
** Check links below
* TAG Review
** Action items - progress
** Architecture S&P assertion review
* AOB

=== 1 August 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/07/18-wot-sec-minutes.html 18 July 2022]
* Wide Review
** [https://github.com/w3cping/privacy-request/issues/86 Architecture] - [https://github.com/w3c/wot-architecture/labels/privacy-needs-resolution privacy issues]
** [https://github.com/w3cping/privacy-request/issues/84 TD] - [https://github.com/w3c/wot-thing-description/labels/privacy-needs-resolution privacy issues]
** [https://github.com/w3cping/privacy-request/issues/83 Discovery] - [https://github.com/w3c/wot-discovery/labels/privacy-needs-resolution privacy issues]
** [https://github.com/w3c/security-request/issues/27 Architecture] - [https://github.com/w3c/wot-architecture/labels/security-needs-resolution security issues]
** [https://github.com/w3c/security-request/issues/26 TD] - [https://github.com/w3c/wot-thing-description/labels/security-needs-resolution security issues]
** [https://github.com/w3c/security-request/issues/25 Discovery] - [https://github.com/w3c/wot-discovery/labels/security-needs-resolution security issues]
** https://github.com/w3c/wot-thing-description/issues/1497
** https://github.com/w3c/wot-discovery/issues/303 (closed)
* TAG Feedback
** https://github.com/w3ctag/design-reviews/issues/736
** https://github.com/w3c/wot-thing-description/issues/1635 - Adjust Policy-Like Assertions (TD)
** https://github.com/w3c/wot-security/issues/208 - Remove References to "Security Best Practices" (All)
** https://github.com/w3c/wot-security/issues/209 - Update "Security and Privacy Guidelines" prior to PR of other deliverables
* Other Issues
* AOB

=== 25 July 2022 ===
Security call cancelled due to testfest.

Please review https://github.com/w3ctag/design-reviews/issues/736 and in particular 
consider how to modify security and privacy assertions in deliverables to make them more testable (point 4 in response to TAG).

=== 18 July 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/07/11-wot-sec-minutes.html 11 July 2022]
* Wide Review
** https://github.com/w3c/wot-thing-description/issues/1497
** https://github.com/w3c/wot-discovery/issues/303
* TAG Feedback
** https://github.com/w3ctag/design-reviews/issues/736
** Some security items need responding to
* Issues
* AOB

=== 11 July 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/06/27-wot-sec-minutes.html 27 June 2022] - reviewed last week
** [https://www.w3.org/2022/07/04-wot-sec-minutes.html 4 July 2022]
* Wide Review
* Issues
* Next Charter Topics
* AOB

=== 4 July 2022 ===
Scribe: Philipp

No agenda - wiki was down.

=== 27 June 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/06/20-wot-sec-minutes.html 20 June 2022] 
* Recently Merged Updates
** [https://github.com/w3c/wot-thing-description/pull/1544 TD - RFC 9200 reference for ACE (pending publication) - merged]
** [https://github.com/w3c/wot-thing-description/pull/1543 TD - auto in header, auto security scheme updates - merged]
** [https://github.com/w3c/wot-thing-description/pull/1542 TD - secure transport in security schemes - merged]
* Pending Updates - Review
** [https://github.com/w3c/wot-architecture/pull/783 Architecture - Specify TLS and DTLS versions - OPEN]
** [https://github.com/w3c/wot-architecture/pull/781 Architecture - Define "Trusted Environment" - OPEN]
* Privacy Wide Review - Updates
** [https://github.com/w3c/wot-thing-description/issues/1497 TD - Identifiers don't seem to rotate enough]
** [https://github.com/w3c/wot-discovery/issues/303 Discovery - Personal devices and public/private TDDs]
** [https://github.com/w3c/wot-thing-description/pull/1547 TD - Privacy updates - merged]
** [https://github.com/w3c/wot-discovery/pull/353 Discovery - Privacy updates - OPEN]
* AOB

=== 20 June 2022 ===
Scribe: Philipp
* Minutes:
** [https://www.w3.org/2022/06/13-wot-sec-minutes.html 13 June 2022] 
* Updates
** https://github.com/w3c/wot-discovery/issues/335 resolved
* IDs (Wide Review Issues)
** https://github.com/w3c/wot-thing-description/issues/1497
** https://github.com/w3c/wot-discovery/issues/303
** Short-term vs. long-term solutions
* auto
** Negotiation vs. apriori knowledge
* AOB

=== 13 June 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/05/30-wot-sec-minutes.html 30 May 2022] 
* Discovery and TLS/DTLS
* Issues & Wide Reviews
* AOB

=== 30 May 2022 ===
Scribe: Jiye
* Minutes:
** [https://www.w3.org/2022/05/23-wot-sec-minutes.html 23 May 2022] 
* Discovery
** [https://github.com/w3c/wot-discovery/pull/313 Discovery Security Bootstrapping]
* Wide Reviews
** Security
*** https://github.com/w3c/wot-architecture/labels/security-needs-resolution
*** https://github.com/w3c/wot-thing-description/labels/security-needs-resolution
*** https://github.com/w3c/wot-discovery/labels/security-needs-resolution
** Privacy
*** https://github.com/w3c/wot-architecture/labels/privacy-needs-resolution
*** https://github.com/w3c/wot-thing-description/labels/privacy-needs-resolution
*** https://github.com/w3c/wot-discovery/labels/privacy-needs-resolution
* Issue Reviews
* AOB

=== 23 May 2022 ===
Scribe: Jiye
* Minutes:
** [https://www.w3.org/2022/05/16-wot-sec-minutes.html 16 May 2022] 
* [https://github.com/w3c/wot-architecture/issues/753 TLS Cleanup]
* IDs
** https://github.com/w3c/wot-thing-description/issues/1497
** https://github.com/w3c/wot-thing-description/issues/1503
* [https://github.com/w3c/wot-discovery/pull/313 Discovery Security Bootstrapping]
* Wide Reviews
** https://github.com/w3c/wot-architecture/labels/security-needs-resolution
** https://github.com/w3c/wot-thing-description/labels/security-needs-resolution
** https://github.com/w3c/wot-discovery/labels/security-needs-resolution
* Issue Reviews
* AOB

=== 16 May 2022 ===
Scribe: Jan/Kaz
* Minutes:
** [https://www.w3.org/2022/05/09-wot-sec-minutes.html 9 May 2022] 
* [https://github.com/w3c/wot-architecture/pull/747 Arch Security and Privacy Considerations update]
* [https://github.com/w3c/wot-discovery/pull/309 Discovery Explainer Draft]
* ID requirements - TD privacy consideration?
* Wide Reviews
* Issue Reviews
** https://github.com/w3c/wot-security/issues/153
* AOB

=== 9 May 2022 ===
Scribe: Jan
* Minutes:
** [https://www.w3.org/2022/05/02-wot-sec-minutes.html 2 May 2022]  
* Wide Review Responses
** https://github.com/w3c/wot-thing-description/issues/1490
*** Summary: PING requesting we disallow "nosec" if TD has PII (or has immutable ID, e.g. if required by law)
*** Same issue probably also applies to discovery
*** BUT: 
**** non-nosec schemes need transport security (TLS) to actually be effective
**** Not really critical on private networks, and TLS is difficult (but not impossible) on private networks, due to CA/Browsers expecting non-local URLs, disallowing self-signed certs, etc. etc.
**** Might still want non-nosec on private networks without TLS to avoid *causal* access
*** Proposal: context-dependent assertions
**** When TDs contain PII or PII can be inferred from them...
***** Note that in general this would not apply to "development" 
**** MUST use (D)TLS/transport security on internet (Things with public URLs), MUST NOT use "nosec" in this case
**** SHOULD ... and SHOULD NOT ... on local (non-public) networks
**** On the public internet not using transport security or authentication is a Bad Idea even for development without PII risk, so maybe there should be a "SHOULD" assertion for this case... or the MUST assertion can just apply to everything, whether or not there is PII at risk.
*** There is an additional problem with "descriptive TDs" e.g. brownfield devices, that may not follow these assertions.  We can't fix such issues in existing devices, but we could add an assertion (to Discovery, say) that such TDs MUST NOT be distributed publicly.
*** See https://github.com/w3c/wot-architecture/pull/747
* Profiles and UUIDs
** See above
* Issues
* AOB

=== 2 May 2022 ===
Scribe: Philipp
* Minutes:
** [https://www.w3.org/2022/04/25-wot-sec-minutes.html 25 April 2022]  
* S&P Considerations
** [https://github.com/w3c/wot-architecture/pull/734 Architecture]
** [https://github.com/w3c/wot-discovery/pull/295 Discovery]
* Best Practices
** https://github.com/w3c/wot-security-best-practices
* Testing
* Issues
* AOB

=== 25 April 2022 ===
Scribe: Jan
* Minutes:
** [https://www.w3.org/2022/04/11-wot-sec-minutes.html 11 April 2022]  
* S&P Considerations
** [https://github.com/w3c/wot-architecture/pull/734 Architecture]
** [https://github.com/w3c/wot-discovery/pull/295 Discovery]
* Best Practices
** https://github.com/w3c/wot-security-best-practices
* Testing
* Issues
* AOB

=== 11 April 2022 ===
Scribe: Philipp
* Minutes:
** [https://www.w3.org/2022/04/04-wot-sec-minutes.html 4 April 2022]  
* S&P Considerations
** [https://github.com/w3c/wot-architecture/pull/734 Architecture]
** [https://github.com/w3c/wot-discovery/pull/295 Discovery]
* Best Practices
** https://github.com/w3c/wot-security-best-practices/pull/32
* Security in Home Assistant
* Testing
* Issues
* AOB

=== 4 April 2022 ===
Scribe: Jiye
* Minutes:
** [https://www.w3.org/2022/03/28-wot-sec-minutes.html 28 March 2022]  
* Recap: PRs recently merged
** [https://github.com/w3c/wot-thing-description/pull/1419 "auto" value for "in" field of security schemes]
** [https://github.com/w3c/wot-thing-description/pull/1421 "auto" Security Scheme]
** [https://github.com/w3c/wot-discovery/pull/287 Discovery - Cleanup]
** [https://github.com/w3c/wot-discovery/pull/286 Discovery - DDOS]
** [https://github.com/w3c/wot-thing-description/pull/1428 TD security consideration consolidation]
* New PRs and Issues
** [https://github.com/w3c/wot-thing-description/pull/1452 Removing "uri" from "in" options where not appropriate]
** [https://github.com/w3c/wot-discovery/pull/295 Making S&P normative in Discovery]
** [https://github.com/w3c/wot-architecture/issues/726 S&P considerations in Architecture]

Future meeting:
* Review Use Cases and Requirements
** https://github.com/w3c/wot-usecases/blob/main/USE-CASES/coverage.csv
* Security Testing Plan
** draft: https://github.com/w3c/wot-testing/pull/210
** repo: https://github.com/w3c/wot-security-testing-plan
* Scripting
** https://github.com/w3c/wot-scripting-api/issues/390
** Discuss how to manage credentials both for normal access and for discovery, provide feedback to Scripting API design
** Consider existing [https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API Credential API] in browser
** Probably should have some suggested assertions - in Architecture, that constrain all implementations (since Scripting API is not normative, but Architecture is)

=== 28 March 2022 ===
Scribe: Jan
* Minutes:
** [https://www.w3.org/2022/03/21-wot-sec-minutes.html 21 March 2022]  
* To do
** [https://github.com/w3c/wot-thing-description/pull/1421 PR for "auto" Security Scheme]
* Recap
** Security and Privacy Considerations
*** [https://github.com/w3c/wot-discovery/pull/287 Discovery - Cleanup]
*** [https://github.com/w3c/wot-discovery/pull/286 Discovery - DDOS]
*** [https://github.com/w3c/wot-thing-description/pull/1428 TD security consideration consolidation]
* Security Testing Plan
** draft: https://github.com/w3c/wot-testing/pull/210
** repo: https://github.com/w3c/wot-security-testing-plan
* Scripting
** https://github.com/w3c/wot-scripting-api/issues/390
** Discuss how to manage credentials both for normal access and for discovery, provide feedback to Scripting API design
** Consider existing [https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API Credential API] in browser
** Probably should have some suggested assertions - in Architecture, that constrain all implementations (since Scripting API is not normative, but Architecture is)
* Architecture
** Need to review and update security and privacy considerations in Architecture
** https://github.com/w3c/wot-architecture/issues/726

=== 28 February 2022 ===
Scribe: Jan
* Minutes:
** [https://www.w3.org/2022/03/07-wot-sec-minutes.html 7 March 2022] 
** [https://www.w3.org/2022/02/28-wot-sec-minutes.html 28 February 2022 (already published)] 
* To do
** [https://github.com/w3c/wot-thing-description/pull/1421 PR for "auto" Security Scheme]
* Security and Privacy Considerations
** [https://github.com/w3c/wot-discovery/pull/287 Discovery - Cleanup]
** [https://github.com/w3c/wot-discovery/pull/286 Discovery - DDOS]
** [https://github.com/w3c/wot-thing-description/pull/1428 TD security consideration consolidation]
* Security Testing Plan
** draft: https://github.com/w3c/wot-testing/pull/210
** repo: https://github.com/w3c/wot-security-testing-plan
* To Do: Scripting
** https://github.com/w3c/wot-scripting-api/issues/390
** Discuss to manage credentials both for normal access and for discovery, provide feedback to Scripting API design
** Consider existing [https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API Credential API] in browser
** Probably should have some suggested assertions - in Architecture, that constrain all implementations (since Scripting API is not normative, but Architecture is)
* To Do: Architecture
** Need to review security and privacy considerations in Architecture
* AOB

=== 28 February 2022 ===
Scribe: 
* Minutes:
** [https://www.w3.org/2022/02/21-wot-sec-minutes.html 21 February 2022] 
* Pending TD updates
** auto for "in"
** security consideration consolidation -> normative
* Review Security Questionnaire for Wide Review
** https://w3ctag.github.io/security-questionnaire/
** https://github.com/w3c/wot-thing-description/pull/1382
* Security Testing Plan
** draft: https://github.com/w3c/wot-testing/pull/210

=== 21 February 2022 ===
Scribe: Philipp
* Minutes:
** [https://www.w3.org/2022/02/14-wot-sec-minutes.html 14 February 2022] 
* Review [https://github.com/w3c/wot-architecture/pull/704 Lifecycle PR] in Architecture (McCool to do)
* TD security scheme problems: https://github.com/w3c/wot-thing-description/issues/1394#issuecomment-1044655255
* New TD security and privacy considerations: https://github.com/w3c/wot-thing-description/pull/1402
* Review Security Questionnaire for Wide Review
** https://w3ctag.github.io/security-questionnaire/
** https://github.com/w3c/wot-thing-description/pull/1382
* Security Testing Plan

=== 14 February 2022 ===
Scribe: Jan
* Minutes:
** [https://www.w3.org/2022/02/07-wot-sec-minutes.html 7 February 2022] 
* Review Security Questionnaire for Wide Review
** For each deliverable... or not?
** https://w3ctag.github.io/security-questionnaire/
** Start github issues
* Issues in Other TFs
** TBD
* Discuss/Finalize Existing PRs
** Discovery: https://github.com/w3c/wot-discovery/pull/264
*** Resolves https://github.com/w3c/wot-discovery/issues/254
** Architecture: https://github.com/w3c/wot-architecture/pull/679
*** Resolves https://github.com/w3c/wot-architecture/issues/672
*** New PR: https://github.com/w3c/wot-architecture/pull/686
**** Continuation of #679
**** "Trusted Environments"
* Discuss New PRs
** Thing Description: https://github.com/w3c/wot-thing-description/pull/1360
*** Resolves https://github.com/w3c/wot-thing-description/issues/1348
*** Security validation as auditing mitigation
* AOB

=== 7 February 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/01/24-wot-sec-minutes.html 24 January 2022] (finalization)
** [https://www.w3.org/2022/01/31-wot-sec-minutes.html 31 January 2022]
* Review Security Questionnaire for Wide Review
** For each deliverable...
** https://w3ctag.github.io/security-questionnaire/
* Issues in Other TFs
** TBD
* Discuss/Finalize Existing PRs
** Discovery: https://github.com/w3c/wot-discovery/pull/264
*** Resolves https://github.com/w3c/wot-discovery/issues/254
** Architecture: https://github.com/w3c/wot-architecture/pull/679
*** Resolves https://github.com/w3c/wot-architecture/issues/672
*** New PR: https://github.com/w3c/wot-architecture/pull/686
**** Continuation of #679
**** "Trusted Environments"
* Discuss New PRs
** Thing Description: https://github.com/w3c/wot-thing-description/pull/1360
*** Resolves https://github.com/w3c/wot-thing-description/issues/1348
*** Security validation as auditing mitigation
* AOB

=== 7 February 2022 ===
Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/01/24-wot-sec-minutes.html 24 January 2022] (finalization)
** [https://www.w3.org/2022/01/31-wot-sec-minutes.html 31 January 2022]
* Review Security Questionnaire for Wide Review
** For each deliverable...
** https://w3ctag.github.io/security-questionnaire/
* Issues in Other TFs
** TBD
* Discuss/Finalize Existing PRs
** Discovery: https://github.com/w3c/wot-discovery/pull/264
*** Resolves https://github.com/w3c/wot-discovery/issues/254
** Architecture: https://github.com/w3c/wot-architecture/pull/679
*** Resolves https://github.com/w3c/wot-architecture/issues/672
*** New PR: https://github.com/w3c/wot-architecture/pull/686
**** Continuation of #679
**** "Trusted Environments"
* Discuss New PRs
** Thing Description: https://github.com/w3c/wot-thing-description/pull/1360
*** Resolves https://github.com/w3c/wot-thing-description/issues/1348
*** Security validation as auditing mitigation
* AOB

=== 31 January 2022 ===

Scribe: Philipp
* Minutes:
** [https://www.w3.org/2022/01/24-wot-sec-minutes.html 24 January 2022]
* Issues in Other TFs
** Remove MD5 from e.g. list for bearer: https://github.com/w3c/wot-thing-description/issues/1362
* Finalize Security and Privacy Consideration Updates
** Discovery: https://github.com/w3c/wot-discovery/pull/264
*** Resolves https://github.com/w3c/wot-discovery/issues/254
** Thing Description: https://github.com/w3c/wot-thing-description/pull/1360
*** Resolves https://github.com/w3c/wot-thing-description/issues/1348
** Architecture: https://github.com/w3c/wot-architecture/pull/679
*** Resolves https://github.com/w3c/wot-architecture/issues/672
*** New PR: https://github.com/w3c/wot-architecture/pull/686
**** Continuation of #679
**** "Trusted Environments"
* AOB

=== 24 January 2022 ===

Scribe: Kaz
* Minutes:
** [https://www.w3.org/2022/01/17-wot-sec-minutes.html 17 January 2022]
* Planning
* Review Issues and PRs
** Profiles, self-description, LAN security
** https://github.com/w3c/wot-discovery/issues/254
** https://github.com/w3c/wot-discovery/pull/264
* AOB

=== 17 January 2022 ===

Scribe: Jiye
* Minutes:
** [https://www.w3.org/2022/01/10-wot-sec-minutes.html 10 January 2022]
* Planning
* Review Issues and PRs
* AOB

=== 10 January 2022 ===
First meeting of 2022.

Scribe: Jan
* Minutes:
** [https://www.w3.org/2021/12/13-wot-sec-minutes.html 13 December 2021]
* Planning
* Review Issues and PRs
* AOB