search

oauth-wg / oauth-cross-device-security

Other
12 stars 7 forks source link

Proposal for Mitigation: User Experience (extension) #87

Closed marcopernpruner closed 1 year ago

marcopernpruner commented 1 year ago

Follows #85 .

(CC @giadas)

User Experience (extension)

During potentially dangerous operations (e.g., reading the QR code on the Authorizing Device), advise users to verify the trustworthiness of the source, for instance by checking that the connection is protected through TLS or by verifying that the URL really belongs to the Authorization Server. In particular, when activating the camera to read the QR code on the Authorizing Device, the activity could also display a warning message advising users to only scan QR codes displayed on a specific website.

Limitations: those already reported in the mitigation

PieterKas commented 1 year ago

After discussing with Daniel, this is very close to the recommendations on user education. We will review that addition and incorporate the recommendation to add warning messages when scanning a QR code, if it is not sufficiently clear already.