FAPI_Meeting_Notes_2019 02 13_Atlantic

FAPI WG Meeting Notes (2019-02-13)

Date & Time: 2019-02-13 14:00 UTC

Location: GoToMeeting https://global.gotomeeting.com/join/321819862

Agenda

• 1.   Roll Call
• 2.   Adoption of the Agenda (Nat)
• 3.   External Organizations
  • 3.1.   ECB (Chris/Ralph/Dave)
  • 3.2.   STET, Berlin Group & Session Fixation in Payment Flows (Torsten)
  • 3.3.   Australia (Ralph)
  • 3.4.   UK OpenBanking (Joseph, Dave)
  • 3.5.   ISO/TC68 (Dave)
• 4.   Draft Status (Nat/Dave)
  • 4.1.   CIBA FAPI Profile (Dave)
  • 4.2.   TR Cross-Browser Payment Initiation Attack (Daniel/Torsten)
  • 4.3.   TR Lodging Intent Pattern (Torsten)
• 5.   Issues
  • 5.1.   #216: TLS_ECDHE_ECDSA cipher suites
  • 5.2.   #215: Financial_API_Lodging_Intent should be an informational document
  • 5.3.   #214: restricting 'aud' in request object to a single value (Joseph)
• 6.   AOB
  • 6.1.   Next Call

The meeting was called to order at 14:05 UTC.

1.   Roll Call

• Attending: Nat, Bjorn, Brian, Daniel, Joseph, Ralph *
• Guests:
• Regrets:
  • Dave, Torsten, John.

2.   Adoption of the Agenda (Nat)

• Accepted as is.

3.   External Organizations

3.1.   ECB (Chris/Ralph/Dave)

• Apparently, only Chris got into the ECB steering group.
• Since it was sponsored by EBA, the final composition was not that surprising.
• Technical community is way under-represented. The tendency may be resulting in un-workable "laws".
• e.g., PSD2 now requiring QSeals only for signatures but that requires a human being to click a button. This is totally unrealistic for API calls.
• For this matter, technical community should produce a concerted effort to promote better ways.
• Ralph is going to send some pointers to the relevant documents.

3.2.   STET, Berlin Group & Session Fixation in Payment Flows (Torsten)

• No updates.

3.3.   Australia (Ralph)

• No updates. It is getting a little slowed down due to local factors.

3.4.   UK OpenBanking (Joseph, Dave)

• Switching to PSD2 mode towards Sandbox was today.
• Production date is 13 March.

3.5.   ISO/TC68 (Dave)

• SR on 19092:2008 biometric authentication going on.

4.   Draft Status (Nat/Dave)

4.1.   CIBA FAPI Profile (Dave)

• Core profile passed implementer's draft vote.

4.2.   TR Cross-Browser Payment Initiation Attack (Daniel/Torsten)

• TR-Cross_browser_payment_initiation_attack.md
• No updates.

4.3.   TR Lodging Intent Pattern (Torsten)

• Financial_API_Lodging_Intent.md

5.   Issues

5.1.   #216: TLS_ECDHE_ECDSA cipher suites

• https://github.com/openid/fapi/issues/216

Need to dig in why BCP195 is recommending only these four cipher suites.

5.2.   #215: Financial_API_Lodging_Intent should be an informational document

• #215
• Torsten seems to be wanting it to be a standard. Since we are lacking both Torsten and Dave from this call, the discussion was postponed to the next call.

5.3.   #214: restricting 'aud' in request object to a single value (Joseph)

• #214
• This has come up when writing a test suit.
• Although Joseph argues that there is no case where multiple aud is justifiably useful, there may actually be in the Open Banking so we need to at least check the current configuration and assess the impact of the change.

6.   AOB

6.1.   Next Call

• Pacific call next week. Nat will not be able to join.
• Atlantic call in 2 weeks time.

The meeting was adjourned at 14:45 UTC.