RE: Next steps for accessible authentication

From: lisa.seeman [mailto:lisa.seeman@zoho.com]
Sent: Monday, June 19, 2017 1:30 PM

We are allowing multiple alternatives, such as:

  *    two step authentication that has a link to press as an alternative to entering a code
[Jason] What are the security implications, if any? The server comprising the destination of the link could be attacked (e.g., by trying different values for the data carried in the link in succession).

  *    two step authentication using devices that sends a tokens via Bluetooth
[Jason] These are promising as an idea, but without standardization, the user may end up having to use several different devices with different Web sites – not a desirable outcome. I think these could only be required in WCAG when the standards are in place.

  *    Email resetting is an option for most places,  including google if people have an alternative address
[Jason] This isn’t suitable for high security applications, since anyone who gains access to the e-mail account can compromise the security of the system.

  *   login in via something like facbook
[Jason] This involves trusting/relying on a third party to perform the authentication. If I remember correctly, this is known to have serious security shortcomings.

  *   conformance to the web authentification specification at https://www.w3.org/TR/webauthn/

[Jason] This is the most promising of your alternatives. Will it be practically available by the time WCAG 2.1 enters Candidate Recommendation?

In short, I think most of the options are at least suspect from a security point of view.


________________________________

This e-mail and any files transmitted with it may contain privileged or confidential information. It is solely for use by the individual for whom it is intended, even if addressed incorrectly. If you received this e-mail in error, please notify the sender; do not disclose, copy, distribute, or take any action in reliance on the contents of this information; and delete it from your system. Any other use of this e-mail is prohibited.


Thank you for your compliance.

________________________________