[{"author": "Aaron Parecki", "text": "

Day 3 here we go!

", "time": "2023-11-10T12:02:31Z"}, {"author": "Justin Richer", "text": "

Token buckets: https://www.ietf.org/archive/id/draft-richer-wimse-token-container-00.html

", "time": "2023-11-10T12:14:16Z"}, {"author": "Aaron Parecki", "text": "

FYI we are 13 minutes behind schedule now

", "time": "2023-11-10T12:33:56Z"}, {"author": "Brian Campbell", "text": "

:)

", "time": "2023-11-10T12:35:28Z"}, {"author": "Aaron Parecki", "text": "

congrats Pieter, we made up 5 minutes on the schedule

", "time": "2023-11-10T12:50:36Z"}, {"author": "John Andersen", "text": "

In this model, couldn't the AS be within the client? Since we already trust it due to it's attestation result?

", "time": "2023-11-10T12:56:55Z"}, {"author": "John Andersen", "text": "

Not always, just as an option. Or does that break some guarantees I'm not seeing

", "time": "2023-11-10T12:58:05Z"}, {"author": "Justin Richer", "text": "

attestation shouldn't be authentication

", "time": "2023-11-10T13:04:28Z"}, {"author": "Justin Richer", "text": "

we should allow attestation on endpoints that also authenticate the client

", "time": "2023-11-10T13:04:48Z"}, {"author": "Jacob Ideskog", "text": "

I strongly agree :)

", "time": "2023-11-10T13:04:56Z"}, {"author": "Aaron Parecki", "text": "

that is what I keep saying

", "time": "2023-11-10T13:05:52Z"}, {"author": "Jacob Ideskog", "text": "

in mobile scenarious attestation is a provenance proof and sometimes more. but that doesn't note equate client authentication. Proving that the app is the right app, serves the same function as the redirect URI does in the code flow (to some extent)

", "time": "2023-11-10T13:07:08Z"}, {"author": "George Fletcher", "text": "

Section 9.8 explicitly calls out that it is NOT RECOMMENDED to leverage this draft for SPAs

", "time": "2023-11-10T13:26:44Z"}, {"author": "Jacob Ideskog", "text": "

@Kristina Yasuda the one authenticator to use for third-party apps is for sure passkeys.
\n@John Bradley another \"challenge\" is that the AS needs to whitelist the applications in the well-known for the web-credentials, smaller issue, but more than just registering the app

", "time": "2023-11-10T13:38:33Z"}, {"author": "Jacob Ideskog", "text": "

forgive me for my ignorance, but doesn't the OIDC Backchannel Logout specification talk about how the OP tells the RPs to logout, I don't remember it having a mechanism for a client to request a logout at the OP?

", "time": "2023-11-10T14:00:58Z"}]