FAPI_Meeting_Notes_2019 02 27_Atlantic

FAPI WG Meeting Notes (2019-02-13)

Date & Time: 2019-02-13 14:00 UTC

Location: GoToMeeting https://global.gotomeeting.com/join/321819862

Agenda

• 1.   Roll Call
• 2.   Adoption of the Agenda (Nat)
• 3.   External Organizations
  • 3.1.   ECB (Chris/Ralph/Dave)
  • 3.2.   STET, Berlin Group & Session Fixation in Payment Flows (Torsten)
  • 3.3.   Australia (Ralph)
  • 3.4.   UK OpenBanking (Joseph, Dave)
  • 3.5.   ISO/TC68 (Dave)
  • 3.6.   IETF:OAuth JAR (John)
• 4.   Draft Status (Nat/Dave)
  • 4.1.   CIBA FAPI Profile (Dave)
  • 4.2.   TR Cross-Browser Payment Initiation Attack (Daniel/Torsten)
  • 4.3.   TR Lodging Intent Pattern (Torsten)
• 5.   Events
  • 5.1.   RSA
  • 5.2.   OAuth Security Workshop
  • 5.3.   IETF
• 6.   Issues
  • 6.1.   #216: TLS_ECDHE_ECDSA cipher suites
  • 6.2.   #215: Financial_API_Lodging_Intent should be an informational document
  • 6.3.   #214: restricting 'aud' in request object to a single value (Joseph)
• 7.   AOB
  • 7.1.   Next Call

The meeting was called to order at 14:05 UTC.

1.   Roll Call

• Attending: *
• Guests:
• Regrets:

2.   Adoption of the Agenda (Nat)

• Accepted as is.

3.   External Organizations

3.1.   ECB (Chris/Ralph/Dave)

3.2.   STET, Berlin Group & Session Fixation in Payment Flows (Torsten)

3.3.   Australia (Ralph)

3.4.   UK OpenBanking (Joseph, Dave)

3.5.   ISO/TC68 (Dave)

3.6.   IETF:OAuth JAR (John)

• OAuth JAR Status

4.   Draft Status (Nat/Dave)

4.1.   CIBA FAPI Profile (Dave)

4.2.   TR Cross-Browser Payment Initiation Attack (Daniel/Torsten)

• TR-Cross_browser_payment_initiation_attack.md
• Need to re-order chapters.

4.3.   TR Lodging Intent Pattern (Torsten)

• Financial_API_Lodging_Intent.md

5.   Events

5.1.   RSA

5.2.   OAuth Security Workshop

5.3.   IETF

6.   Issues

6.1.   #216: TLS_ECDHE_ECDSA cipher suites

• https://github.com/openid/fapi/issues/216

Need to dig in why BCP195 is recommending only these four cipher suites.

6.2.   #215: Financial_API_Lodging_Intent should be an informational document

• #215
• Torsten seems to be wanting it to be a standard. Since we are lacking both Torsten and Dave from this call, the discussion was postponed to the next call.

6.3.   #214: restricting 'aud' in request object to a single value (Joseph)

• #214
• This has come up when writing a test suit.
• Although Joseph argues that there is no case where multiple aud is justifiably useful, there may actually be in the Open Banking so we need to at least check the current configuration and assess the impact of the change.

7.   AOB

7.1.   Next Call

• Pacific call next week. Nat will not be able to join.
• Atlantic call in 2 weeks time.

The meeting was adjourned at 14:45 UTC.