Creation of BBK requirements document #277
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/cc @pejic |
rsolomakhin
requested changes
Nov 8, 2024
rsolomakhin
approved these changes
Nov 11, 2024
github-actions bot
added a commit
that referenced
this pull request
Nov 11, 2024
SHA: 2ad7194 Reason: push, by ianbjacobs Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
github-actions bot
added a commit
that referenced
this pull request
Nov 11, 2024
SHA: 2ad7194 Reason: push, by ianbjacobs Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
||
| Secure Payment Confirmation provides a convenient "sign what you see" experience for a user to agree to the terms and conditions of a transaction, and where Web Authentication is used to generate cryptographic evidence of the user's agreement. | ||
|
|
||
| The payments industry has indicated that SPC would further benefit from a device binding capability. As WebAuthn passkeys can now be synced, it can be argued that they no longer meet strict 2FA requirements (being no longer a signal of device possession), and so SPC (like WebAuthn) is reduced to a single factor (biometric or possession, depending on the authentication method used). |
There was a problem hiding this comment.
reduced to a single factor (biometric or possession, depending on the authentication method used).
In what case can SPC/WebAuthn still provide possession, given syncing? Was this meant to read "biometric or knowledge" ?
There was a problem hiding this comment.
Yep, that was a bug. I've fixed it in the merged version. Thank you!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a first draft resulting from discussions within the Web Payment Security IG (during TPAC) and the 10 October 2024 WPWG meeting.
This proposal is intended to inform discussion of #271.