[wg/webauthn] Web Authentication Working Group

[plehegar]

New charter proposal, reviewers please take note.

Charter Review

Charter:

What kind of charter is this? Check the relevant box / remove irrelevant branches.

• Existing
  • [x] Existing WG recharter

diff from previous charter

diff with charter template

Horizontal Reviews: apply the Github label "Horizontal review requested" to request reviews for accessibility (a11y), internationalization (i18n), privacy, and security. Also add a "card" for this issue to the Strategy Funnel.

Communities suggested for outreach:

None. The Working Group is the right place.

Known or potential areas of concern:

None.

Where would charter proponents like to see issues raised? (this strategy funnel issue, a different github repo, email, ...)

https://github.com/w3c/charter-drafts/issues

Anything else we should think about as we review?

Nope

cc @nadalin @YubicoDemo

[plehegar]

Discussed by WG at:

• 02/07
• 02/21

[plehegar]

PING is looking at/cleaning ongoing issues.

[ruoxiran]

no comments or requests from APA.

[himorin]

no comment or request from i18n

[plehegar]

All good for PING

[plehegar]

(TiLT approval has been requested, with a month extension)

[himorin]

• charter status at the top table is better to be replaced with standard two links??
• in 5.2, FIDO 2.0 WG lacks a link, and also it's FIDO2 Technical Working Group? (not sure 'Technical' is mandatory or not)

[svgeesus]

Why has the charter template text about testing been removed?

[simoneonofri]

From the Security side and as mentioned in the call, I would propose in the Success Criteria to add the following wording:

The security considerations section must include a comprehensive threat model with threats, attacks, mitigations and residual risks.

This structure of this section is indicated by the Security and Privacy Questionnaire and in the referenced RFC3552 - Guidelines for Writing RFC Text on Security Considerations.

In this specific case, the section has very good content and refers to the Web Authentication Threat Model within the FIDO documentation.

[plehegar]

@himorin @svgeesus @simoneonofri , I addressed all of the comments as part of https://github.com/w3c/charter-drafts/pull/491

[plehegar]

changes in https://github.com/w3c/charter-drafts/pull/491 were approved by the WG btw

[svgeesus]

Looks good to me now, thanks!

[nadalin]

Thank you

[simoneonofri]

thank you @plehegar

[plehegar]

Announced https://lists.w3.org/Archives/Member/w3c-ac-members/2024AprJun/0017.html