This is a public summary of the 4-hour virtual meeting of the Web Payment Security Interest Group, held 6-7 October 2020. Questions? Ian Jacobs [email protected].

The group covered three topics related to EMV® 3-D Secure (3DS).

EMVCo and FIDO presented recent work about how FIDO authentication data may be structured as input to an EMV® 3DS authentication request for risk assessment. This topic is particularly interesting in light of other discussions within the WPSIG about how browsers are evolving to reduce fingerprinting capabilities.

Stripe and Google presented work on "Secure Payment Confirmation" (SPC). Their hypothesis is that users will prefer a Web Authentication step during an EMV® 3DS flow, over a traditional one-time password step up. A pilot program is underway and we anticipate hearing early results by the end of the year.

EMVCo presented an EMV® 3DS roadmap. We anticipate that the WPSIG may be invited to review one of the deliverables related to browser guidelines.

EMVCo presented an update on EMV® Secure Remote Commerce.

FIDO introduced the agenda of their upcoming Authenticate conference. EMVCo, FIDO, and W3C are organizing a session at the conference to discuss the WPSIG's work on "How EMVCo, FIDO, and W3C Technologies Relate."

We discussed the process for publishing "How EMVCo, FIDO, and W3C Technologies Relate" as an Interest Group Note after formal review by each organization. We anticipate the document will be made public around mid-November. The document describes the core capabilities provided by core specifications from the three organizations, what problems can be solved by combining them, and potential changes to improve how they work together.

WPSIG invited two groups for discussion about privacy and payments.

The Privacy Community Group incubates specifications to advance privacy protection for users in a predictable fashion. We discussed the group's current work items and their potential impact on payments use cases. It was suggested that the WPSIG formalize a description of its risk assessment use cases for subsequent discussion with the CG.

The Privacy Interest Group shared information about its primarily deliverables, a Self-Review Questionnaire (co-authored with the Technical Architecture Group) for groups developing specifications, and guidance on mitigating fingerprinting in Web specifications.

The WPSIG similarly invited two groups for discussion about authentication.

The Web Authentication Working Group summarized changes between Level 1 and Level 2 of their specification. We discussed some of the challenges that implementers have encountered in experiments to treat mobile devices as local authenticators (via unpaired bluetooth) to create a seamless multi-device authentication experience.

The Web Authentication Adoption CG discussed its efforts to lower barriers that developers might face in the deployment of Web Authentication. The group discussed implementation across different languages and framemworks, best practices and training. Attendees expressed interest in the CG curating a resource about available authenticators and hardware.