search

oauth-wg / oauth-cross-device-security

Other
12 stars 7 forks source link

Proposal for Mitigation: OTP Verification #86

Closed marcopernpruner closed 1 year ago

marcopernpruner commented 1 year ago

Follows #85.

(CC @giadas)

OTP Verification

In the User-Transferred Session Data Pattern and Backchannel-Transferred Session Pattern, before authorizing the attempt, the Authorizing Device could display an OTP to be inserted back in the Initiating Device. In case the QR code or the push notification was generated without the users' consent, they would not have performed any action on the Initiating Device, and therefore they would not know where to insert the OTP they received.

Limitations: Attackers could deceive users into revealing the OTP through other means (e.g., via email) and use it to finalize the authorization process; the additional step could reduce the usability level of the protocol.

Effect on attacks (Table 1): disrupt.

PieterKas commented 1 year ago

Discussed with Daniel and proposal is to include as an additional mitigation and position this as part of the user authentication (i.e. not a protocol extension). It makes it harder to scale attacks, as the attacker has to find a way to recover the PIN as well.