search

privacycg / is-logged-in

The IsLoggedIn API
93 stars 10 forks source link

Auto-complete of second factors such as SMS codes should be consider browser mediated #22

Open johnwilander opened 4 years ago

johnwilander commented 4 years ago

In addition to the use of WebAuthn or a password manager, auto-complete of an SMS code may also be a trustworthy signal of the user logging in and should be included in the browser mediated category.

gffletch commented 3 years ago

SMS based "authentication" has been 'restricted' by NIST circa 2017. https://www.onespan.com/blog/nist-softens-guidance-sms-authentication

At the same time, push notifications to a trusted App are much more secure. While the browser can't detect this (push to app) method directly, it is a better authentication method than SMS codes. I am concerned about the browser treating this method as a "mediated" method which is less secure than other methods which can not be classified as "mediated". It may push sites to use less secure authentication methods which weakens the security of the user.