Saturday, June 28, 2008

Passive phish prevention policy

Clients have an important role to play in preventing the FPA (federated phish attack), as I discovered.

Separate from any role the client might play for authentication to the OP (and thereby actively prevent a phish), it has a role in passively spotting mismatches between the 'where I think I am going' and the 'where I am actually going'.

But this sort of functionality is invisible to the OP (and has nothing to do with the authentication of the user) so it can't be factored into PAPE (nor easily into SAML AuthnContext).

Were clients to advertise this functionality through some header (a la SAML PAOS advertisement), then the OP could include it in PAPE (with a new URI to distinguish this from the active sort of phish prevention).

No comments: