-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2024 05 16_Pacific
Date & Time: 2024-05-16 00:00 UTC Location: https://zoom.us/j/97456084642?pwd=bTRFVzk4ZmlRK1M3bEprRlN5c3JFZz09
Agenda
The meeting was called to order at 00:00 UTC.
- Attendees: Mark, Nat, Dima and Ed
- Regrets:
- May 28-31 in Las Vegas – OIDF is planning to have breakout room if the WG is interested in meeting
- FAPI WG is confirmed for F2F meeting on Wednesday, May 29, 2024 7-8am PT in Bluethorn 8 on the same level as the expo floor.
- June 4-7 in Berlin. OIDF Workshop on June 4.
- June 11th: https://www.openbankingexpo.com/canada/. OIDF doesn't currently have anyone attending but that may change
- OIDF workshop in the Mountain View area on Monday, October 28th prior to IIW. Location yet to be determined.
- Open Banking Rule Making in the US. OIDF putting together open letter to CFPB director to clarify points made in recent remarks at FDX Summit.
- Will share with Board of Directors for feedback before publishing the letter to the OIDF website
https://github.com/openid/fapi/issues/673 Notes From Atlantic call to review: - Agreement current clause allows for a wider set of cipher suites for endpoints used by web browsers - Discussion around some banks supporting legacy ciphers for compliance reasons - Proposal to add a line to the FAPI 1 vs FAPI 2 differences table to clarify FAPI 2 is more permissive in this area - Restriction are for non-browser endpoints - Text from FAPI 1
- ::
- For the authorization_endpoint, the authorization server MAY allow additional cipher suites that are permitted by the latest version of BCP195, if necessary to allow sufficient interoperability with users' web browsers or are required by local regulations. NOTE: Permitted cipher suites are those that BCP195 does not explicity say MUST NOT use.
Notes from Atlantic call to be reviewd:
- https://github.com/openid/fapi/issues/680
- Provide hints to implementers to mitigate impersonated domain validated certificates
- It is hard to test and so we will not make it normaitve.
- Consensus to leave current text as-is recommending but not requiring CAA records, as requiring them would be outside the scope of FAPI
- Still processing last call working group comments, on track for FAPI 2 to be final by end of August
Next call will be an Pacific Call. Next Pacific call will be in two weeks (05-30-2024 @ 5pm PST) UTC - 05-31-2024 1:00 AM.