Re: Mikes request that we identify an upper limit on the number of digits

Hi Lisa,



> LS: there are lots of ways to do this securely. such as…



I covered this in the email yesterday, but there are two types of implementations we are confusing:



  1.  Hardware / apps that supply the secure token / biometrics
  2.  Browser support that connects to those secure devices.



WebAuth is the right standard to refer to, but the current browser support is Chrome-only<https://caniuse.com/#search=fido>, and that is desktop-only as the U2F devices generally use USB.



Is there another way that I’m missing? Otherwise I can’t see how we could get 2 implementations (which is probably why WebAuth is still in draft).





> there are thousands of conforming sites. examples of conforming sites That I use only yesterday include:  the w3c and the EU site for research funding which allows multiple log in methods



I’m confused about that as I was given a password for W3C which I have to type in every time. (Well, I use lastpass, but we seem to be ignoring auto-filling password tools).



I assume those are sites which let you reset email, for which my question was: Is the intent that the email reset logs you in automatically?

A typical implementation would have you copy the new password into a username/password form to login, which I wouldn’t have thought conforms?





> Any level of security can be reached. including use of tokens and dongles , smartcards etc.



But we haven’t shown that for *web content*, I don’t think “use desktop chrome” is a good answer here.



Also, how do you get past the username/password bit? You can set the second factor to remember your device for a set time (usually 30 days), but at some point you would still have to login with a password and with the 2nd factor, otherwise there is no security



Then the last (more complex) level, how do you conform if you are the email-provider? If you can’t provide an email-loop, and you use 2FA, I can’t see how that would work in theory, let alone practice.



If this is getting a security review, can we make sure that is considered? Otherwise it is very hypothetical.



Cheers,



-Alastair