Re: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

[Giridhar Mandyam <[e-mail]>]

Sent from my Verizon, Samsung Galaxy smartphone
Get Outlook for Android<https://aka.ms/AAb9ysg>
________________________________
From: Ian Jacobs <[e-mail]>
Sent: Tuesday, May 23, 2023 5:44:42 PM
To: Giridhar Mandyam <[e-mail]>
Cc: [e-mail] <[e-mail]>; Stephen McGruer <[e-mail]>; Philippe Le Hégaret <[e-mail]>
Subject: Re: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

Hi Giri,

> On May 23, 2023, at 11:20 AM, Giridhar Mandyam <[e-mail]> wrote:
>
> Hi Ian,
>> Apologies if I have missed this: what is the To Do item? Do you mean publication as a Candidate Recommendation?
>
> Per  https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration:
>
> "TODO: Find a better way to do this. Needed currently because other members are auth-time only"

Good catch! Because we expect that member to be required for some time, we will simply remove the TODO note. We’ve just merged
a pull request removing the note; the spec should be updated shortly:
 https://github.com/w3c/secure-payment-confirmation/pull/244

>> I’m not sure what you mean by “caching/freshness of assertions.” SPC does not involve caching of assertions. Is there a passage in the specification that is raising a concern?
>
> "... and also allows the browser to identify and cache Secure Payment Confirmation credentials".  I may have overloaded the significance of what is intended behind caching of credentials.  I assumed that if credentials are cached then their usage (assertions) may also be cached.

Another good catch. Only credential IDs are cached. We will change the specification to say "cache SPC credential IDs” and I hope that will address
the concern.

>> We endeavor to address these topics in our Security Considerations [1] and Privacy Considerations [2] sections, including:
>
> OK.  Might be good to put a reference to those sections in the extension registration.

Thank you for the suggestion. I’ve updated the extension registration draft (below) to include those links.

Ian


========================
Extension identifier: payment

Description: This extension supports the following functionality defined by the Secure Payment Confirmation API: (1) it allows credential creation in a cross-origin iframe (2) it allows a party other than the Relying Party to use the credential to perform an authentication ceremony on behalf of the Relying Party, and (3) it allows the browser to identify and cache Secure Payment Confirmation credentials. For discussion of important ways in which SPC differs from Web Authentication, see in particular the <a href="https://www.w3.org/TR/secure-payment-confirmation/#sctn-security-considerations”>Security Considerations</a> and <a href="https://www.w3.org/TR/secure-payment-confirmation/#sctn-privacy-considerations”>Privacy Considerations</a>.

Reference: [<a href="https://www.w3.org/TR/secure-payment-confirmation/“>Secure Payment Confirmation</a>] Section §5, WebAuthn Extension - "payment"

Change Controller: [<a href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a>]

Notes: Registration follows <a href="https://www.w3.org/2023/05/03-webauthn-minutes#t01">3 May 2023 discussion</a> with the Web Authentication Working Group.

========================
For Contact Information

Id: [<a href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a>]

Name: W3C Web Payments Working Group

Contact URI: mailto: [e-mail]

Last Updated: <date>

--
Ian Jacobs <[e-mail]>
https://www.w3.org/People/Jacobs/
Tel: [phone]