Meeting minutes
<Kevin Dean> https://
Phil Archer: In this call, we must cover a few topics which may take somem time. Wes raised issued on API. Manu Sporny's presentation in Dublin.
Phil Archer: The goal is to try to collaborate peacefully.
<Phil Archer> TPAC agenda https://
Phil Archer: Kevin also has a issue to discuss. Does anyone have any issues for next week, slots are built around timezones.
Phil Archer: barcode and DI will be covered West coast timezeone. and other work focusing on Eastern timezones
Issues in DC API
Wesley Smith: suggest Manu Sporny goes first. issues related to slide deck which provides bigger picture.
<Manu Sporny> DC API Interoperability Concerns wrt. W3C VCs: https://
Manu Sporny: DC API interoperability concerns, shared in the chat channel.
Manu Sporny: this is largely the work of Wes. Spoke to Dave and other VCWG participants, and industry trade groups. Convenience retail, also W3C member. Also been run by several California agencies that are deploying VC API. Digitar Bazar directly involved integrating this with several VC formats.
Manu Sporny: this will happen on Tuesday of TPAC in the web payments SIG. 2 day meeting. Joint meeting of several interest groups (FIDO Alliance, credit cards related orgs.) The presentation is intended to be high-level.
Manu Sporny: Focus is on use cases. Current API makes it impossible to implement these use cases. Propose solutions that the VCWG has been working on if there is a will to do so.
Manu Sporny: three main things that will be discussed. There are many other topics.
Manu Sporny: This is coming from deployment experience in production, 50+ states in the US. Retail stores. have been deploying W3C VCs for years now. 152k stores. NACS : are in 45 countries. Other usecase is the California state, and California education system.
Manu Sporny: Manu is not representing these organisations. He is not speaking for them. In the retail sector, typical usecase where DC API doesn't work. Instead of using a physical wallet, you buy a product and at checkout your age needs to be proven, provide gas card, coupons and offers want to be provided by the store. How can this happen in a single
click ?
Manu Sporny: DC API can't do this as many back and forth for issuance and verification. 8-16 taps required. Bad user experience. This has been solved in VCALM which can do issuance and verification in one flow.
<Phil Archer> [Manu Sporny is sharing his slides in the Zoom channel but they're linked in the minutes]
Manu Sporny: second use case is picking up a credential online. Authentication using VC driver's licence (mDoc) and DMV issues a W3C VC. not supported because Apple because they block non mDOC requests. Also refuses APIs that are not both Apple phones.
Manu Sporny: This is very complicated and creates bad UX. Want platforms and browsers to not block requests that are not of the "right" VC format.
Manu Sporny: Consistency is required. Third usecase : verifiers must be registered with Apple or Google store. This means that a verifier has to do this for each wallet they want to support. This is difficult for a small retailer.
Manu Sporny: the ask is to reuse website certificates to verify the verifier.
Manu Sporny: Summary of the requested changes.
Manu Sporny: multi-credential flow. DC API consistency - all formats over all platforms to create a unified experience. Please don't set up a seperate PKI infrastructure for verifiers. Don't put platform vendors of who can issue and verify on the web.
Manu Sporny: these issues have been raised by Wes. Does the VCWG agree with these issues ?
<Wesley Smith> w3c-fedid/
Wesley Smith: links to these issues in IRC.
<Wesley Smith> w3c-fedid/
Wesley Smith: thanks to Manu Sporny for the high-level view. links to specific issues provided. Some issues cannot be raised as PRs. Do VCWG members engage with such use cases ? Would be good if the group had a unified perspective on VC API versus VCALM.
Manu Sporny: +1 to wes. in the federated id WG when they rechartered to VC API, we were listed as a mandatory liaison. In theory, this group should have been engaged before candidate rec. Has there been a request for horizontal review ? But is it too late ? These issues have been pointed to for years and they have not been addressed. Raised "surprise" in the FIWG.
Manu Sporny: The issues have been raising issues with real customers.
Phil Archer: doesn't know which Android did it did way, linked to their business model. Are we challenging their business models ???
Phil Archer: pointing at process will not matter if this is the case.
Phil Archer: I'm playing devil's advocate here. How much does this resonate with others not from Digital Bazar.
Wesley Smith: Concerning business models, absolutely not. Issue 594: what we are requesting gives individual companies agency about what they require, such as high-assurance flows. what we are asking is to make sure that in the list of supported protocols you include one that doesn't require high assurance.
<Michael Shea> +1 to Will's comment
Will Abramson: this is a great presentation.
Dmitri Zagidulin: +1 to everythng said before. These are important use cases. Want to add that this goes into anti-trust territory. Ability to support global standards is important from this perspective.
Ted Thibodeau Jr.: strongly encourage everyone to join in FIWG, there is active participation by Chrome and Android Google folks. Some participation by Apple.
Ted Thibodeau Jr.: the arguments about UX will be the strongest Apple will hear. However the reason they do not support a technical thing are issues related to security and privacy. Sometimes what they see as a problem will take years to surface. The iPhone was a 20 year project.
Ted Thibodeau Jr.: just stating problems will not get the desired effect.
Ted Thibodeau Jr.: the strongest argument will be UX which is their bread and butter.
Ted Thibodeau Jr.: Google just does AB testing on users. UX is not priority.
Michael Shea: +1 to all that was said. UX is horrific. Is this presentation available ?
Phil Archer: the presentation is intended to be shared.
<Ted Thibodeau Jr.> the deck is freely shareable -- https://
Phil Archer: The TPAC we are talking about can be joined remote.
<Ted Thibodeau Jr.> (it may be tweaked up to the actual TPAC session)
<Wesley Smith> +1 Phillip Long, this is an extensibility concern
Phillip Long: this is also about future-proofing.
Wesley Smith: UX is about things being unpleasant. But this will make some use cases impossible and will harm the ecosystem. Retail stores will not access flows that increases check out time.
Phil Archer: confirm that checkout time is fundamental, even 1 second is too much.
Manu Sporny: thanks to wes. Does anyone in the group object to us presenting any of this content?
Ivan Herman: does not object. so far, to understand the question, do you want this presentation to be made in the name of the VCWG ?
Manu Sporny: It's too much to ask for this to be the WG's position. Experience from Digital Bazar. VCWG has taken to a look at it and doesn't object. But it is not an official position.
Phil Archer: the presentation was given to our WG and everyone on the call was fully supported. even the scribe who doesn't have time to speak!
Bitstring Status List
<Phil Archer> Open PRs https://
Phil Archer: Mea Culpa, I joined the DI and Barcode TF and learned the bitstring status was assigned to this group.
w3c/vc-bitstring-status-list#220
Kevin Dean: there are a couple of PRs, bitstring compression and encoding steps. result of issue 209 which wanted additional constraints on the gzip compression. Some things may have privacy implications (e.g. filename, comment, etc. )
Kevin Dean: we have added some normative requirements stating that this is binary. no extra data. Should not have fname or fcomment and modification timestamp is zero. These will be SHOULD and not MUST.
Kevin Dean: minor changes to the text about the multi-base encoding and slight fix to decompression method. I have also expanded the terminology a bit, there was a single compressed bitstring composed in two parts. I have broken that out to detail the encoding steps.
Manu Sporny: Thanks. Looks good. Have you checked against implementations? Test to the test suites ? reminder to label this a class change 1234 ? We are just clarifying the text.
Manu Sporny: make sure to track all changes to report easily.
Kevin Dean: will look into that. Only normative change that could affect an implementation are these two: details them. But this is very rare implementation as it refers to old OS only.
Ivan Herman: if there are privacy or secrutiy issued, we are authorized by our charter.
w3c/vc-bitstring-status-list#219
Kevin Dean: I don't have authority to add labels in this repo.
Kevin Dean: expanded bitstring algorithm: This addresses an ambiguity in the spec about the bit ordering. and deficiency when a status has more than one bit assigned to it. Bit to byte ordering.
Kevin Dean
Kevin Dean: MSB first by Digital Bazar. Prevaling convention in the ecosystem.
<Ted Thibodeau Jr.> MSB = Most Signficant Bit
Kevin Dean: I have expanded the documentation to provide a normative alg. for MSB ordering. This is quite detailed. The net result is if you took the entirety of the bitstring, each status would appear in their position.
Kevin Dean: this is the logical reason behind the MSB ordering
Kevin Dean: this is a simple set of mathematical statements.
Manu Sporny: looks good. Exactly what we wanted.
<Dave Longley> +1 looks good, just needs double checking with implementations/test suites.
Phil Archer: Kevin to join the TF meeting next week.
Manu Sporny: labels being added to the repo.
Phil Archer: Ivan Herman there is another PR
Ivan Herman: that should be gone. Maybe Wes knows ?
Ivan Herman: prefer that someone looks over changes made in the github.
Manu Sporny: I'll look at it.
VCDM vocabulary - ttps://github.com/w3c/vc-data-model/pull/1652
Ivan Herman: lots of work done to make the new version of the vocab. Want to merge this knowing new versions are coming, from Kayode. But first step is merging what we have.
Phil Archer: do you want to resolve to merge?
Ivan Herman: anyone opposing it?
Phil Archer: Dimitri, Ted have looked at it. Dave?
aob
Phil Archer: a few things before we finish. If joining remotely, TPAC infrastructure is typically very good.
Phil Archer: last week I was at a big GS1 event, lovely surprise about the construction industry. Presentation by Ecowise
Phil Archer: She talked about digital signatures but
Phil Archer
Phil Archer: it was about W3C VCs. was happy to see that !
<Manu Sporny> Carolynn: They are one of the CIRPASS pilots, so of course they used W3C technology :)
<Michael Shea> OF course!
Phil Archer: brent will be with us next week.
<Sebastian Schmittner> we are in here https://
<Phillip Long> next meeting?
<Sebastian Schmittner> Sebastian Schmittner
Dmitri Zagidulin: on tuesday is did WG overlapping with VCWG meeting ?
Manu Sporny: there should not be an overlap
Phil Archer
<Dmitri Zagidulin> the week after is IIW! :)
Phil Archer: the week after TPAC there will be no TF meetings.
<Michael Shea> Thx Phil!