Create 2025-10-06-minutes.md

Author: torgo

meetings/2025-10-06-minutes.md

@@ -0,0 +1,50 @@
+# SWAG Minutes - Mon 6 October 2025
+
+Present: Dan, Aaron, Florian, Will
+
+## Survey
+
+- Dan to look into the form
+- Dan: Need to update the text on the last page to say to join the SWAG CG
+- Dan: Should be ready to launch afterwards
+
+## Supply chain attacks article
+
+- Dan: reached out to OpenSSF, unfortunately nobody commented so far
+- https://github.com/mdn/content/pull/41034
+- Will: need to address some comments from Florian but we can merge afterwards
+- Dan to leave a review
+
+## Prototype Pollution PR
+
+Florian : hope this will be ready by next week's call.
+
+## Authentication
+
+- Plan: https://docs.google.com/document/d/1miZbXVjs070J2HH0rsDxqPnUaqNtPP51Uo8d4FU6PTk/edit?tab=t.0
+- New own sub tree on MDN
+- Dan: Do you want to talk about legcy auth? Like when web developers come across HTTP auth etc. These are still used in the wild and maybe we should say "don't use them!"
+- Will: That's worth talking about
+- Dan: Also something on the usage of SMS 2FA and how it's not great
+- Dan: Could be that MFA is its own topic
+- Will: Not sure where to put it yet, information architecture problem
+- Dan: *ranty* Passkeys aren't always a replacement for passwords, sometimes there are still passwords and passkeys used both as ways for authentication
+- Will: Passkeys are still relatively new. Same for OTP etc. Its hard to know when to recommend which.
+- Dan: Another risk is portability of passkeys.
+- Will: Not sure what the story is here for the docs
+- Will: Passwords are good for portability and passkeys aren't
+- Dan: Understanding how the form interacts with the password manager is super important.
+- Will: There is a great article by Hidde about this: https://hidde.blog/making-password-managers-play-ball-with-your-login-form/
+- Florian: How can we involve the new WICA CG?
+- Dan: We can loop them in our PRs
+- Dan: Also they might be quite focused on the promotion of passkeys
+- Will: Wonder if we should give them context prior to sending them PRs, like sending them this outline.
+- Dan: *reaches out to Hidde*
+- Florian: reach out to major identiy proviers such as MS Identity, Google Identity, Octa? 
+
+## Other topics
+
+- *discussion of quality of OWASP cheat sheets*
+- SWAG Breakout at TPAC?
+- https://github.com/w3c/tpac2025-breakouts
+- We should attend https://github.com/w3c/tpac2025-breakouts/issues/3