RE: 03/22/2023 W3C Web Authentication Meeting

I have sent a note out and updated the W3C calendar to confirm this meeting 

 

From: Shane B Weeden <sweeden@au1.ibm.com> 
Sent: Sunday, March 26, 2023 10:15 PM
To: ANTHONY NADALIN <nadalin@prodigy.net>; Christiaan Brand <cbrand@google.com>; Adam Langley <agl@google.com>
Cc: W3C Web Authn WG <public-webauthn@w3.org>
Subject: Re: 03/22/2023 W3C Web Authentication Meeting

 

Hi Tony, 

 

Can you please confirm that the f2f is going ahead in San Francisco on April 21 (Friday) and that Adam will be delegated chair, and that Christiaan is managing pre-registration?

 

Also @Christiaan - I am fairly sure this has been pointed out before, however your invitation says April 20 (Friday) when actually the Friday is April 21.

 

Thanks,

Shane.

 

 

 

 





On 22 Mar 2023, at 12:08 pm, nadalin@prodigy.net <mailto:nadalin@prodigy.net>  wrote:

 

This Message Is From an External Sender

This message came from outside your organization.

Here is the agenda for the 03/22/2023 W3C Web Authentication WG Meeting, that will take place as a 60 minute teleconference. Remember call is at NOON PDT. 

 

 

Select scribe please someone be willing to scribe so we can get down to the issues

 

1. Here is the link to the Level 2 Webauthn Recommendation  https://www.w3.org/TR/2021/REC-webauthn-2-20210408/
2. First Public Working Draft of Level 3 has now been published, https://www.w3.org/TR/webauthn-3/

3. PWG Update (John B.)
4. RSA (4/24-27)and TPAC (9/11-15) in person meetings possibilities (Adam)
5. Web Payments Joint Meeting 3/27-29th Participation 
6. L3 WD01 open pull requests and open issues

 

Pull requests · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/pulls?q=is%3Aopen+is%3Apr+milestone%3AL3-WD-01> 

1. Recommend duration of challenge validity by emlun · Pull Request #1855 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/pull/1855> 
2. Improve guidance around using UV by emlun · Pull Request #1774 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/pull/1774> 

 

Pull requests · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/pulls?q=is%3Aopen+is%3Apr+no%3Amilestone> 

1.       Add links to and update all numbered step references by emlun · Pull Request #1864 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/pull/1864> 

2.       Use i18n-glossary definition of [=grapheme cluster=] by emlun · Pull Request #1863 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/pull/1863> 

3.       Only expose the UV PRF by agl · Pull Request #1836 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/pull/1836> 

 

Issues · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues?q=is%3Aopen+is%3Aissue+milestone%3AL3-WD-01> 

1. Add  <https://github.com/w3c/webauthn/issues/1835> "smart-card" to AuthenticatorTransport enum (WebKit) · Issue #1835 · w3c/webauthn (github.com)
2. Prescriptive behaviours for Autofill UI · Issue #1800 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1800> 
3. Enforce backup eligibility during assertion · Issue #1791 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1791> 
4. Facility for an RP to indicate a change of displayName to a discoverable credential · Issue #1779 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1779> 
5. Should enterprise attestation support be flagged explicitly? · Issue #1742 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1742> 
6. Attestation on Get Assertion · Issue #1741 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1741> 
7. Discussing mechanisms for enterprise RP's to enforce bound properties of credentials · Issue #1739 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1739> 
8. Provide passwordless example, or update 1.3.2. to be a passwordless example · Issue #1735 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1735> 
9. Update top level use cases to account for multi-device credentials · Issue #1720 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1720> 
10. Public Key Credential Source and Extensions · Issue #1719 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1719> 
11. RP operations: some extension processing may assume that the encompassing signature is valid · Issue #1711 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1711> 
12. Split RP ops  <https://github.com/w3c/webauthn/issues/1710> "Registering a new credential" into one with and one without attestation · Issue #1710 · w3c/webauthn (github.com)
13. Switch to permissive copyright license? · Issue #1705 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1705> 
14. Platform Errors for attestations. · Issue #1697 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1697> 
15. Should an RP be able to provide finer grained authenticator filtering in attestation options? · Issue #1688 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1688> 
16. Lookup Credential Source by Credential ID Algorithm returns sensitive data such as the credential private key · Issue #1678 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1678> 
17. Synced Credentials · Issue #1665 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1665> 
18. Cross-origin credential creation in iframes · Issue #1656 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1656> 
19. Trailing position of metadata · Issue #1646 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1646> 
20. [Editorial] Truncation description inaccurate · Issue #1645 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1645> 
21. Mechanism for encoding *direction* metadata may need more work · Issue #1644 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1644> 
22. Use of in-field metadata not preferred · Issue #1643 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1643> 
23. Unicode  <https://github.com/w3c/webauthn/issues/1642> "tag" characters are deprecated for language tagging · Issue #1642 · w3c/webauthn (github.com)
24. U+ notation incorrect · Issue #1641 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1641> 
25. Syncing Platform Keys, Recoverability and Security levels · Issue #1640 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1640> 
26. Possible experiences in a future WebAuthn · Issue #1637 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1637> 
27. reference CTAP2.1 PS spec and fix broken link · Issue #1635 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1635> 
28. Missing Test Vectors · Issue #1633 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1633> 
29. CollectedClientData.crossOrigin default value and whether it is required · Issue #1631 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1631> 
30. Support for remote desktops · Issue #1577 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1577> 
31. Prevent browsers from deleting credentials that the RP wanted to be server-side · Issue #1569 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1569> 
32. Support a  <https://github.com/w3c/webauthn/issues/1568> "create or get [or replace]" credential re-association operation · Issue #1568 · w3c/webauthn (github.com)
33. Adding info about HSTS for the RPID to client Data. · Issue #1554 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1554> 
34. Making PublicKeyCredentialDescriptor.transports mandatory · Issue #1522 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1522> 
35. double check whether the Secure Payment Confirmation effort has implications on the WebAuthn spec · Issue #1492 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1492> 
36. cleanup  <https://github.com/w3c/webauthn/issues/1489> <pre class=anchors> and use <pre class="link-defaults"> as appropriate · Issue #1489 · w3c/webauthn (github.com)
37. Regarding the issue of Credential ID exposure(13.5.6), from what perspective should RP compare RK and NRK and which should be adopted? · Issue #1484 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1484> 
38. Personal information updates  <https://github.com/w3c/webauthn/issues/1456> & webauthn · Issue #1456 · w3c/webauthn (github.com)
39. Requesting properties of created credentials. · Issue #1449 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1449> 
40. More explicitly document use cases · Issue #1389 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1389> 
41. Addition of a network transport · Issue #1381 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1381> 
42. Minor cleanups from PR 1270 review · Issue #1291 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1291> 
43. Clearly define the way how RP handles the extensions · Issue #1258 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1258> 
44. add feature detection blurb... · Issue #1208 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1208> 
45. think about adding note wrt how client platform might obtain authenticator capabilities · Issue #1207 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1207> 
46. Update name, displayname and icon for RP and user · Issue #1200 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1200> 
47. export definitions? · Issue #1049 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1049> 
48. ReIssues · w3c/webauthn (github.com)covering from Device Loss · Issue #931 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/931> 
49. undefined terms and terms we really ought to define · Issue #462 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/462> 

 

Issues · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues?q=is%3Aopen+is%3Aissue+-label%3Astat%3AOnGoing+-label%3Astat%3Apr-open+no%3Amilestone> 

 

1.       WebAuthn Autofill (Conditional UI) for credential registration · Issue #1862 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1862> 

2.       Clarify how to differentiate between exceptions · Issue #1859 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1859> 

3.       Clarify the need for truly randomly generated challenges · Issue #1856 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1856> 

4.       Allow conditional and modal flows to run simultaneously · Issue #1854 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1854> 

5.       Add a new  <https://github.com/w3c/webauthn/issues/1852> "note" to registration options for RP's to help users distinguish credentials · Issue #1852 · w3c/webauthn (github.com)

6.       Add topOrigin to clientData for cross-origin GET in iframe · Issue #1842 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1842> 

7.        <https://github.com/w3c/webauthn/issues/1819> "android-key" and "android-safetynet" are really basic attestation type support? · Issue #1819 · w3c/webauthn (github.com)

8.       Variable reference issue in DPK processing rules · Issue #1817 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1817> 

9.       Possibility to filter diplayed authenticators by certified level · Issue #1816 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1816> 

10.   Dependencies section is out of date and duplicates terms index · Issue #1797 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1797> 

11.   Enterprise attestaion is a bool in WebAuthn and an Int in CTAP2.1 · Issue #1795 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1795> 

12.   Credential discovery is unclear · Issue #1789 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1789> 

13.   Better specify what an unknown type credential descriptor being ignored means · Issue #1748 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1748> 

14.   Spec abstract is out of date on the eve of multi-device credentials and cross-device auth · Issue #1743 · w3c/webauthn (github.com) <https://github.com/w3c/webauthn/issues/1743> 

15.   Cross origin authentication without iframes (accommodating SPC in WebAuthn) · Issue #1667 · w3c/webauthn · GitHub <https://github.com/w3c/webauthn/issues/1667> 

 

  

4.   Other open issues

5.   Adjourn

Because of toll fraud issues MIT has been experiencing, I've been asked to change our call coordinates and password and, as an ongoing thing, not distribute the call coordinates publicly. That means not including the WebEx call number or URL in our agendas or minutes.

 

You can find the new call coordinates at this link, accessible with your W3C member login credentials.

https://www.w3.org/2016/01/webauth-password.html <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.w3.org%2F2016%2F01%2Fwebauth-password.html&data=04%7C01%7Ctonynad%40microsoft.com%7C9cd59d2cfccb46b0986d08d82dcf4b7c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637309715629125857%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=rRnXdea9sqPx%2B7Z8fbc7bv%2F5nY%2BLZStYSARGKVdH1pA%3D&reserved=0>  

 

 

 

 

Get Outlook for Android <https://aka.ms/ghei36>