[blink-dev] Re: Intent to Ship: Private State Tokens API

I'm quite excited to see this ready to ship, thanks for the work you've put into it over the years. Both Mozilla and Apple's positions seem dependent upon analysis of the underlying Privacy Pass protocol. Have you had additional communication with them about how things are going, since it's bee

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

Folks from Mozilla have done some recent analysis on the privacypass protocol and some supportive of the general protocol, however we haven't gotten any newer signals on whether the PST system where some sites are issuers and other sites redeem tokens is of interest to them. Apple has been pursuing

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

Thanks. https://github.com/WICG/trust-token-api/blob/main/PST_VS_PAT.md#privacypass-version suggests that the privacypass versioning concern that Apple raised in https://github.com/WebKit/standards-positions/issues/72#issuecomment-1279177030 will be mitigated through the protocol solidifying nowis

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

The larger differences between privacypass and PST include some of the token versions that we are currently using and that privacypass supports. Even once the core drafts get standardized (which may still be months out) we'll need to update drafts for the token types we're using in PST and get thos

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

So, you're sticking to the current version (which is an older version of privacypass) and will switch to the latest version once it stabilizes? What's the forward compat story for this as well as future changes to the privacypass protocol? On Mon, Mar 20, 2023 at 3:54 PM 'Steven Valdez' via blink-

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

The primary features are generally the same, with some internal format/wire format changes. Only the clients implementing the API and the issuers will need to make code changes to update to the new version, websites calling the fetch/JS APIs will not need to make any changes. We also believe that t

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

Hi Steven, Is the issuer registration process documented somewhere (I don't see anything in the explainer or spec)? Also, just to make sure I understand - when the upgrade to the latest privacy pass draft happens, will that add a new value to the TokenVersion

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

The WIP registration document is at https://docs.google.com/document/d/1oB_YdRMvQWWAsqXsvxMr4FJCngcSBj2rLJzW15l8a_A/edit?usp=sharing . We're planning on hosting it on a Github repo and using that as the source of truth for issuer registrations. There's a couple of "versions" in the API, the field

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

I will note that the current state of the specification does not seem to match IETF Privacy Pass documents. I think that shipping is premature on that basis. Mozilla deferred our position on this because the specifications were not in a particularly healthy state at the time. That situation does

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

Thanks - so it seems the value of Sec-Private-State-Token-Crypto-Version will change, after the update to the latest privacypass spec happens. Forgive another naive question - is there any utility for an issuer/redeemer to support multiple Sec-Private-State-Token-Crypto-Version versions, besid

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

Hey Martin, On 3/31/23 3:38 AM, Martin Thomson wrote: I will note that the current state of the specification does not seem to match IETF Privacy Pass documents.  I think that shipping is premature on that basis. Mozilla deferred our position on this because the specifications were not in a

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

Hi Mike, Unfortunately, I think that the specification needs considerable work before it would be considered to be acceptable. I've started filing issues, but I am finding it rough going. It is very hard to follow, it lacks basic explanations of key features and their operation (this information

Re: [blink-dev] Re: Intent to Ship: Private State Tokens API

Thanks for filing issues! On 4/3/23 8:59 PM, Martin Thomson wrote: Hi Mike, Unfortunately, I think that the specification needs considerable work before it would be considered to be acceptable.  I've started filing issues, but I am finding it rough going.  It is very hard to follow, it lacks