Re: [W3C Web Crypto WG] Rechartering discussion

Hi Colin & Co,

I'm also disappointed but I saw it coming years ago when all questions about future work were immediately dismissed.
Now the future is here and we haven't a single specification that has been properly evaluated.
In that situation, the only thing left (for the W3 NB...) is "saving face" and start a moderately interesting maintenance activity or divert to things that were not discussed in Mountain View like the credential management thing initiated by Google.

BTW, I don't think that the W3C Payment activity will consider using WebCrypto.

IMO, all the use-cases presented in Mountain View touched the following so far unsolved issue:
http://webpki.org/papers/web-browser-security-enigma.pdf
Well, there's a bunch of disparate WG's that are sort of looking into this but what gives that?

Anders

On 2015-01-08 03:32, Colin Gallagher wrote:
> Hello,
>
> As a participant in the Sept. 10-11, 2014 Web Crypto Next Steps
> http://www.w3.org/2012/webcrypto/webcrypto-next-workshop/
> (and as a person who had a paper (however brief) accepted for that workshop),
> -- 
> It sounds as though there is an effort underway to limit the scope of what this group will be discussing, in such a manner that would not include user-managed storage of keys, and that would attempt to diminish the importance of trustless systems while encouraging users to place more trust in exchange for convenience in various ways with a variety of services, but where this group for rechartering as has been proposed above, would only focus on "rechartering discussions in specific and narrow scopes if such proposals have consensus (in particular, from user agents)" uh-huh.
>
> At least, that's what the drift of it sounds like to me, and I don't like the sound of that.  I sense this strange struggle where:
>
> tl'dr"  some people don't want users to be in control of their keys, and would rather info dump into the vast ether of FISA, business records, 3rd party cromnibus, etc., because hey, it's important to make sure that you squeeze all the profit you can out the users before discarding them, right?
> or,
> other people, perhaps wanting to give the users a better chance, try to give the users more of a choice in where they will store their keys and what happens next (thanks maxwell and chris and those at keybase, as examples).
>
> Please advise what is the course of the group.  Thank you. I just don't want to be here if the basic course is "oh let's um narrow it and try to throw people to the wolves but pretend we're not"
>
> tl'dr:  Change course.
>
> -c
>
>
>
>
>
> On Wed, Jan 7, 2015 at 4:31 PM, Richard Barnes <rlb@ipv.sx <mailto:rlb@ipv.sx>> wrote:
>
>
>
>     On Wed, Jan 7, 2015 at 7:43 PM, Ryan Sleevi <sleevi@google.com <mailto:sleevi@google.com>> wrote:
>
>         As noted during the F2F during the 2014 TPAC, it's unlikely we would
>         be able to support such a rechartering.
>
>         In the goals, only the first goal is something that aligns with our interest.
>         In the scope, we are explicitly not interested in "user managed"
>         storage and "web certificate management". Further, we don't believe
>         this group is the appropriate venue for the discussion of Web
>         Authentication - that would be better for WebApps or WebAppSec.
>         WebAppSec already has proposals for dealing with credentials -
>         http://lists.w3.org/Archives/Public/public-webapps/2014JulSep/0141.html
>
>         Put differently, for a rechartering, the only effort we'd likely
>         support support is the maintenance and exploration of algorithms.
>
>         Any other chartering discussions should follow the highly productive
>         workmodes of WebApps and WebAppSecs - that is, concrete, defined
>         proposals being brought forth and holding rechartering discussions in
>         specific and narrow scopes if such proposals have consensus (in
>         particular, from user agents).
>
>
>     Reserving the right to disagree with Ryan on the particular scoping above, I strongly agree with the above paragraph.  None of the proposed work items to date has been defined in enough scope to make it clear what a WG would do.
>
>     --Richard
>
>
>
>         On Wed, Jan 7, 2015 at 1:48 AM, GALINDO Virginie
>         <Virginie.Galindo@gemalto.com <mailto:Virginie.Galindo@gemalto.com>> wrote:
>         > Dear all,
>         >
>         >
>         >
>         > Web Crypto WG charter [1] will end by the end of March. We need to prepare
>         > the next charter of Web Crypto.
>         >
>         >
>         >
>         > As a reminder, the conversation has started on this page :
>         > https://www.w3.org/Security/wiki/IG/webcryptonext_draft_charter
>         >
>         > Feel free to add you ideas and suggestions on the wiki and/or expose your
>         > opinion and question on the public-webcrypto@w3.org <mailto:public-webcrypto@w3.org> or
>         > public-webcrypto-comment@w3.org <mailto:public-webcrypto-comment@w3.org> (for non W3C Web Crypto WG members).
>         >
>         >
>         >
>         > Regards,
>         >
>         > Virginie
>         >
>         >
>         >
>         > [1] http://www.w3.org/2011/11/webcryptography-charter.html
>         >
>         >
>         >
>         > ________________________________
>         > This message and any attachments are intended solely for the addressees and
>         > may contain confidential information. Any unauthorized use or disclosure,
>         > either whole or partial, is prohibited.
>         > E-mails are susceptible to alteration. Our company shall not be liable for
>         > the message if altered, changed or falsified. If you are not the intended
>         > recipient of this message, please delete it and notify the sender.
>         > Although all reasonable efforts have been made to keep this transmission
>         > free from viruses, the sender will not be liable for damages caused by a
>         > transmitted virus.
>
>
>