Subject: [saag] W3C update for IETF 98 (WebCrypto REC, WebAppSec Recharter, WebAuthn, Web Payments)

From: Wendy Seltzer <[email-masked]>
Date: Thu, 30 Mar 2017 10:47:36 -0400

An update on security-related W3C activities:

* WebCrypto is a W3C Recommendation
   https://www.w3.org/TR/WebCryptoAPI/

* The Web Application Security WG re-chartered through 2018:
   https://www.w3.org/2011/webappsec/charter-2017.html

The group's mission is to develop security and policy mechanisms to
improve the security of Web Applications, and enable secure cross-origin
communication. The re-charter extended its scope to include
Vulnerability Mitigation, new work on Attack Surface Reduction, and work
on the Web Security Model.

 Content Security Policy Level 2 is a Recommendation;
development is ongoing in CSP Level 3
   https://www.w3.org/TR/CSP2/
   https://www.w3.org/TR/CSP/

 Candidate Recommendations:
   Referrer Policy: https://www.w3.org/TR/referrer-policy/
   Secure Contexts: https://www.w3.org/TR/secure-contexts/
   Mixed Content: https://www.w3.org/TR/mixed-content/
   Upgrade Insecure Requests:
<http://www.w3.org/TR/upgrade-insecure-requests/>

* Web Authentication WG is actively developing the WebAuthn API
   https://www.w3.org/TR/webauthn/

* Web Payments drafts are nearing Candidate Recommendation
   https://www.w3.org/Payments/WG/

Overview of related groups:
   https://www.w3.org/Security/

PING (Privacy Interest Group) will meet informally over lunch Thursday.
   https://www.w3.org/Privacy

Happy to talk about any of these.
--Wendy

-- 
Wendy Seltzer -- [email-masked] +1.617.715.4883 (office)
Policy Counsel and Domain Lead, World Wide Web Consortium (W3C)
http://wendy.seltzer.org/        +1.617.863.0613 (mobile)