Re: [Agenda] 27 November Card Payment Security Task Force

Hi Ian, TF members,

Please can you clarify a few questions I have about the wiki:

https://github.com/w3c/src/wiki/UX-Assumptions-and-Requirements#cross-src-enrollment
"Based on 13 November 2020 discussion, we should not assume that all SRC
payment handlers will be able to enroll a card in all SRC systems."

What does it mean to "enroll a card in an SRC system"? I thought an example
of an SRC System was the VISA network and therefore if my bank issues me a
VISA card it is from the VISA SRC System.

Can I "enroll" that card on other SRC systems?
If so, what does it mean to do this?

https://github.com/w3c/src/wiki/UX-Assumptions-and-Requirements#cross-src-display-and-selection
"Based on 13 November 2020 discussion, we should not assume that all SRC
payment handlers will be able to display a card from any SRC system for
selection."

What is the limiting factor?
Do SRC payment handlers need to be "certified" or have some form of
relationship (technical/business) with all of the SRC systems they can
display a card from?
Is this roughly the same as "supportedNetworks" in basic card?

https://github.com/w3c/src/wiki/UX-Assumptions-and-Requirements#add-card-based-on-pan-entry
"The user would enter a PAN, leading ultimately to installation of a
relevant payment handler capable of enrolling that PAN"

This implies that knowing the SRC system for a card is enough to select an
appropriate SRC payment handler that could enroll the card.
This further implies that payment handlers will be published by the SRC
systems. (i.e. There will be an SRC payment handler from VISA, from
MasterCard etc)
Is this correct?

"[pre-installed] payment handlers can support "add card: functionality."

This contradicts the earlier statement that not all payment handlers can
enroll cards from all SRC systems.

Some clarifying questions which remain unanswered:
1. Would SRC-System-Published Payment Handlers live alongside DCF-published
payment handlers?
2. If so, what flow would lead a user to installing a DFC-published handler?

https://github.com/w3c/src/wiki/UX-Assumptions-and-Requirements#no-payment-handler--wallet-selector
"Users must be able to select an instrument for payment without an
intermediate step of selecting from a set of available payment handlers
(wallets)."

It is impossible to provide this experience and provide users with choice.
If a merchant supports multiple payment methods (including SRC) and some of
these are specific to a wallet (e.g. PayPal, Google Pay, Apple Pay) then
the user MUST be prompted to select a wallet.

If the requirement is restated as "without an intermediate step of
selecting from a set of available *SRC* payment handlers" then the answer
is for SRC cards to be installed as individual payment handlers and appear
in the selection list, branded by SRC system alongside non-SRC wallets.

The question remains, as I have already asked in another thread, what
happens in this case but where the user has no SRC payment handler
installed?
The user is prompted to choose between "Bob Pay, Other Pay and ???????"
What is the desired user experience here?

"prompting the user to select one from among multiple wallet options is not
an acceptable user experience to bootstrap the ecosystem."

This seems like a bootstrapping/distribution problem for SRC payment
handlers not something that the W3C needs to solve.
Any other payment method that wants to bootstrap it's ecosystem will face
the same challenges.
The primitives are there to use: URL based payment method identifiers,
payment method manifests with default payment handlers that are JIT
installed etc.


On Tue, 26 Nov 2019 at 20:58, Ian Jacobs <ij@w3.org> wrote:

> Dear Card Payment Security Task Force,
>
> Agenda for 27 November:
>
>  * I have summarized proposals that I have read to help address SRC UX
> requirements:
>
> https://github.com/w3c/src/wiki/UX-Assumptions-and-Requirements#design-ideas
>
> I would like to review current ecosystem expectations around those topics,
> most notably whether
> there will be one or more payment handlers capable of speaking with the
> various SRC systems,
> or whether each SRC system will have its own payment handler. In the
> latter case, we seem to be
> able to manage the user experience of displaying and selecting instruments
> in the sheet, but
> solving for “add card” functionality is a challenge.
>
> Also, I am still seeking volunteers to do SRC demos (of the current
> deployments) for the full WG
> at their 12 December call.
>
> Call info:
>
> - Usual call time: 11am-noon ET (4-5pm UTC)
> - WebEx: http://www.w3.org/2018/11/cps.ics
> - IRC: irc.w3.org in the channel #wpwg
>
> Thank you,
>
> Ian
>
> --
> Ian Jacobs <ij@w3.org>
> https://www.w3.org/People/Jacobs/
> Tel: +1 718 260 9447
>
>
>
>
>
>