Web Security Context (WSC) WG Face-to-face #2 Agenda (v 1.0)

While the agenda is due two weeks before our f2f, I've version numbered 
it, so we can be dynamic in the face of topics that become unnecessary 
(discussion of Notes sections that were already covered in our meeting the 
week before) and topics that should be inserted (particularly any demos, 
while we're all together).  And any typographical corrections or updates. 

__________________________________________________________

Web Security Context (WSC) WG Face-to-face #2 Agenda (v 1.0) 
2007-01-30 through 2007-01-31 
San Jose, CA, USA

Phone number and IRC channel to be documented on WG administrative home 
page 
http://www.w3.org/2006/WSC/Group/ 

Teleconference time and lengh information, tbd 
8:30 - 17:30 both days, local time 

Tuesday, 2007-01-30 - Chair, Mary Ellen Zurko 

Breakfast (8:30) 

1. Administrative details (9:00) 
Including:

1a. Selection of scribes 
One per 1/4 day (total of 8)

1b. Brief roll call 
Make sure you've already posted an introduction to yourself on our list 

2. Agenda bashing (9:15) 

3. WG schedule review (9:30)

4. Discussion of major Note sections not already covered in our previous 
meetings 
If any of these get covered in the meetings in the run up to the f2f, 
we'll remove them from the f2f agenda 

4a. Assumptions (10:00)

Break (10:45)

4b. Design Principles (11:15)

Lunch (12:00) 

4c. User Test Verification (13:00)

4d. Problem with Current User Interface (13:45) 

Break (14:30)

5. Demos 

5a. Petname  (15:00)
Demo by Tyler

5b. EV (16:00) 
Demo by Phil

6. Day one wrapup (17:00)
Any logistics, agenda changes for the next day, other actions, etc. 

Recess (17:30)


Wednesday, 2007-01-31 - Chair, Mary Ellen Zurko 

Breakfast (8:30) 

7. Agenda bashing (9:00)

8. Best of breed Mozilla extensions for displaying security context 
information (9:15)
Presentation led by Mike B 
Will include Beltzner's Suggested Do's And Don't From Being a Brower UI 
Guy 

Break (10:15)

9. Recommendation 1 discussions

Editors are needed

9a. Minimal set of security context information (10:45)

The description of our first recommendation begins with:
A W3C Recommendation that specifies a minimal set of security context 
information to be made accessible to users, ...

We'll discuss what that means and brainstorm on what that minimal set 
might be. The minimal set can be targeted at the combination of web user 
agents, web application authoring, and web server deployment guidelines. 

Lunch (12:00)

9b. Best practices for usable presentation of this information (13:00)

The description of our first recommendation continues with:
and best practices for the usable presentation of this information 

This will be a good time for us to get categories (and instances) of 
potential best practice on the table. Anything put forward will have to be 
validated as we go forward, using the techniques outlined in the 
Assumptions section of our Note. It's recommended that people post ideas 
in this area to the list (and re-post them marked with an indicator that 
they're for this list if they were part of earlier discussions). 

Draft categories for best practices: 
o Straight up usable display of security context information - for each 
piece of information, best practice on what to display to the user
.. in its presence and absence
.. alone and in combination with other pieces of security context 
information
.. with and without additional user discovery (e.g. main display vs. 
requested dialogs) 

Break (14:30)

10. Recommendation 2 discussions (15:00)

The description of our second recommendation begins:
a W3C Recommendation that specifies techniques that render the 
presentation of security context information more robust against spoofing 
attacks. The Group expects to establish two levels of conformance to these 
techniques: required and recommended. 

Draft categories for security context information robustness:
o Limitations on scripting capabilities 
o Shared and protected "secrets" - both cryptographic and human (i.e. 
personalization) 
.. and protection of those secrets 
o Trusted path between web user agent and user 
o Safe mode browsing (restrictions on allowed browsing activity based on 
one or more levels of security context required)


11. Wrapup (17:00)
Any follow up action items, decisions on editor(s) of the 
recommendation(s). 

Recess (17:30)