121–128 of 128 posts
So there's now a protocol for the browser to transparently share payment data with websites but we still can't get something to let the browser transparently log us in to websites?
That's what Mozilla Persona (not the theming system) was meant to be, but apparently people didn't care enough for it for websites to implement it. [1] https://en.wikipedia.org/wiki/Mozilla_Persona
Earlier quoted context omitted.
Is there a source for this? That seems like a pretty outrageous thing for a browser to do.
Not sure if the talk has been uploaded, but: https://twitter.com/chrismorrisorg/status/896352427426799618
Earlier quoted context omitted.
> Anyone can join the W3C, and anyone can participate in a working group / contribute to a standard. Starting at ~10 000 USD per year, sure
It's worth noting that while it costs money to join the W3C, W3C membership isn't a requirement to participate in most (maybe even all now?) WGs where you can simply join the mailing list or subscribe to the GitHub repo and contribute.
Earlier quoted context omitted.
I was referring to the client being the System of Truth. Auto-fill for some fields in an eCommerce transaction is allowed for convenience, true, but not all (PAN and CVV, for example). Plus, processors apply significant fraud detection on transactions from merchants performing card-not-present transactions and will frequently require escrow accounts for merchants lacking a proven low-chargeback frequency or for those…
Pretty sure Chrome autofill will store CVV. I think for most people using Chrome autofill for CCs, Chrome is already the System of Truth for CC, to quite the same extent it would be under this new system. No banks or retailers seem to be complaining about it at present. I don't see the difference between browser filling in these details with auto-fill, or browser filling in these details with a Payment Request API. A…
... Chrome is already the System of Truth for CC ...
I don't see the difference between browser
filling in these details with auto-fill,
or browser filling in these details with a
Payment Request API. Are you suggesting
there is a significant one?
From the perspective of a transaction processor, they will see the client request the same and treat it as being untrusted until verified against their System(s) of Truth as well as satisfying ancillary verifications.
As such, a client device can never qualify as being authoritative due to its assumed compromised state (from the perspective of a processor).
Earlier quoted context omitted.
This became a thing lately: https://developers.google.com/web/updates/2016/04/credential...
Built in pw manager with JS api. Nothing special. Doesn't fix anything.
Example scenario: user signs up for a site on Chrome desktop. When they visit the site from their phone, they're automatically signed in, they don't even see a login screen.
Earlier quoted context omitted.
Built in pw manager with JS api. Nothing special. Doesn't fix anything.
It's more than that, it syncs user login credentials across devices, and can auto-sign in users without them having to go through a login form. Example scenario: user signs up for a site on Chrome desktop. When they visit the site from their phone, they're automatically signed in, they don't even see a login screen.
Earlier quoted context omitted.
Not sure if the talk has been uploaded, but: https://twitter.com/chrismorrisorg/status/896352427426799618
Ahh, that completely changes the meaning. It's basically just like credit card processing in that case, but just for Android Pay (and probably Apple pay if/when they adopt the API). The transaction description/line item thing makes a lot of sense from a user perspective (granted, I am not, and do not intend on becoming, an Android Pay or Apple Pay user).
Earlier quoted context omitted.
It's more than that, it syncs user login credentials across devices, and can auto-sign in users without them having to go through a login form. Example scenario: user signs up for a site on Chrome desktop. When they visit the site from their phone, they're automatically signed in, they don't even see a login screen.
Does it by default generate a password or there is STILL a way for user to set their own? If the latter, then it won't change anything. We must hide pw field entirely from the user.