Add Service Canada

[daylenca]

Site name

Service Canada

Site URL

https://www.canada.ca/en/employment-social-development/services/my-account.html

Documentation URL

https://www.canada.ca/en/employment-social-development/services/my-account/multi-factor-authentication.html

Supported 2FA methods

• [X] TOTP (RFC-6238, Google Authenticator)
• [ ] Proprietary Software (Authy, Duo, etc.)
• [ ] FIDO2/U2F/WebAuthn security keys
• [ ] Proprietary hardware (Yubico OTP, RSA keys, etc.)
• [X] Phone calls
• [X] SMS tokens
• [ ] Email tokens

Eligibility

• [X] I have checked that the site meets 2fa.directory's contributing guidelines and site criteria
• [X] The site is ranked within the top 200,000 sites on Similarweb or has a substantial social media following.
• [X] The site does not contain or promote content that violates 2fa.directory's excluded categories and websites guidelines, including pornographic, discriminatory, or unlawful content.
• [X] The issue I'm creating is not a duplicate of an existing issue.
• [X] The issue I'm creating is not a duplicate of an existing pull request

Additional information

canada.ca.json is currently being used for the Canada Revenue Agency. The Government of Canada uses the same domain for other government agencies (such as Service Canada), but most agencies run their own login system with differing 2FA protocols. What would be the best naming convention to use for the json files due to this? An icon for this site (canada.ca.svg already exists). Also, please restrict the region to ca. Thank you.

[Carlgo11]

So every agency uses the same domain and subdomain?

If that's the case then it would be very tricky to implement 🤔

[daylenca]

So every agency uses the same domain and subdomain?

If that's the case then it would be very tricky to implement 🤔

Yes, the main government services are provided through canada.ca, though some smaller agencies have their own sub-domains. Most agencies all accept the same methods (SMS, phone, TOTP and passcode grid), but a few (like the Canada Revenue Agency) don't accept TOTP. As you could likely imagine, autofill using a password manager is a nightmare.

[Carlgo11]

Alright. At the moment it's hard to multiple entries for the same FQDN. While it would technically be possible, it would mess things up and possibly even break things for third parties using our API and so listing multiple entries with the same FQDN may do more harm than good.

I'm a bit surprised the developers behind canada.ca chose to go this route as it deviates from the web standard. I'm sure the ARPANET engineers would cry if they saw this.