<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On Mar 29, 2022, at 11:32 AM, Kristina Yasuda via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi Vladimir,<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thank you for the question! SIOPv2 over NFC has not been discussed in the WG before.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I think it would be interesting to explore this topic. We could use NFC/BLE instead of QR codes to convey `request_uri` as a first step, or sending ID Token and VPs (and other issuer-signed credentials) over NFC/BLE in the response (though it will be a leap from RESTful nature of OIDC). We would need someone knowledgeable in NFC (and BLE?) to participate and contribute in the WG if we are to pursue this path.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I am curious, is there an emerging use-case beyond 2.1 and 2.2 quoted below?</div></div></div></blockquote><div><br class=""></div>I can help a fair bit here with capabilities; no so much with real world deployment issues (such as real numbers on things like battery impact).</div><div><br class=""></div><div>Usability and experience wind up driving a lot of the design choices here. For instance, CTAP combines the tap with the user presence consent which makes the flow pretty simple. For credential release though, we would want to have a prompt in-between.</div><div><br class=""></div><div>From a usability standpoint it might be better to initiate with a QR code and confirm with a NFC tap (or BLE broadcast.)</div><div><br class=""></div><div>-DW</div><div><br class=""></div><div><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Best,<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Kristina</div></div></blockquote></div></body></html>