Create 2025-09-29-minutes.md

Author: torgo

meetings/2025-09-29-minutes.md

@@ -0,0 +1,100 @@
+# SWAG Minutes - Mon 29 September 2025
+
+Present: Dan, Florian, Will, Giovanni
+
+## Plans for survey
+
+From Simone: [paraphrased] We won't ask for e-mail but we will ask them to join the community group if they would like to be interviewed...
+
+So what is the next step?
+
+*we debate whether this will be too much friction*
+
+Will: alternative - people could respond on social media.
+
+*we agree to share the survey - and ask people to join the CG if they want to participate in further discussions*
+
+*Dan to work on text.*
+
+## PR 29 Merged
+
+https://github.com/w3c-cg/swag/pull/29
+
+Dan: I committed Will's feedback....
+
+## Merge PR 31?
+
+https://github.com/w3c-cg/swag/pull/31
+
+Floran : wrote an article about SSRF 
+
+Dan: *leaves positive review*
+
+*we agree good to merge*
+
+## Discussion on Passkeys?
+
+Will: next thing I want to work on is - authentication - see below - happy to get feedback. I had feedback from Martina - we should really talk about Passkeys - as they are a thing that uses web authentication. She also gave more detail and useful info that I will incorporate into the outline. So updated the outline.
+
+Dan: Anything for our own guidelines?
+
+Will: It might be good to use guidelines around authenticaiton... its own section? 
+
+Dan: feels like it should be in security_guidelines.md - as a separate section.
+
+Florian: there's a new CG on credentials and authentication adopton.. Maybe nice to work together. https://www.w3.org/community/wica/
+
+Simone: this group was an idea from webauthn wg... to promote the adoption of web authentication... a web layer for passkeys. The main problem is the developer needs to choose  to use it... I have a list of different authenticaiton types - we can use that. We could also talk with Tim C. directly.
+
+Dan: I suggest we write something ... and then reach out for comment...
+
+Florian: we are working on MDN.. they are working on microsties - we can still share experience.
+
+Will: *will file a SWAG issue* I agree having another top level section in security_guidelines... is the right approach. 
+
+## Concrete Attacks 
+
+From Florian :"What are concrete attacks you expect to be documented for MDN readers? (web developers, library developers, etc.)
+The attacks we already have are listed here: https://developer.mozilla.org/en-US/docs/Web/Security/Attacks.
+Work in progress articles which we will have soon are: Supply chain attacks, Phishing, IDOR."
+
+New content in review, feedback appreciated:
+- Supply chain attack article: https://github.com/mdn/content/pull/41034
+- IDOR attack: https://github.com/mdn/content/pull/41200
+- JavaScript Prototype Pollution: https://github.com/mdn/content/pull/41260
+  - Thanks for the great feedback so far! Will try to work it in the next few days
+- Thinking about writing about DOM Clobbering as well
+- More?
+
+Florian: we're writing documentation for concrete attacks... some are still in review... Supply chain attacks is an open PR... Working on prototype pollution... Lots of feedback...   One more in review - indirect object reference... 
+
+*discussion on graphql and we agree not to write on this at this time*
+
+Florian: another topic - DOM clobbering attacks... Nice article from Frederick... Might quality for an MDN article as well... Coming to an end with this work...  Soon going to switch to authenticaiton.
+
+## Supply chain attacks
+
+https://github.com/mdn/content/pull/41034 - merge?
+
+Dan: let me ask for some additional review... from the OpenSSF community.
+
+*we agree to give Dan a day before merging*
+
+Simone: [on threat modelling] - one of the discussions with the digital credentials API - they were complaining that I listed threats with them ... one proposal was move to a separate doc "threat model for the web"... I will reference the threats that you already have documented.
+
+... we should also talk about "the human web" the threats going to be exploited regarding the human, not only the technical things... 
+
+Dan: examples?
+
+Simone: e.g. https://www.panmacmillan.com/authors/tim-berners-lee/this-is-for-everyone/9781035023677 - privacy covers covers many but there are some threats missing... e.g. attention hijacking on social networks ... deceptive patterns ... trying to publish a summary of these threat models somewhere.  3 models ... one is technical - e.g. autoplay, infinite scrolling,... there are some technical remediation... also C2PA could be a potential remediation... Article 25 in EU could be a policy remediation... 
+
+Florian: we touched on this a bit - when we wrote about Phishing attacks - also a glossary entry on social engineering... https://developer.mozilla.org/en-US/docs/Glossary/Social_engineering
+
+Simone: https://www.nirandfar.com/how-to-manufacture-desire/ ... as an example ... 
+
+## Authentication
+
+Plan: https://docs.google.com/document/d/1miZbXVjs070J2HH0rsDxqPnUaqNtPP51Uo8d4FU6PTk/edit?tab=t.0 .
+
+
+Please review