Feat: introduce pairing support to protect against shoulder surfing #98
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sietseringers
requested changes
Jul 24, 2020
sietseringers
requested changes
Sep 2, 2020
sietseringers
requested changes
Sep 6, 2020
sietseringers
force-pushed
the
master
branch
from
b57ed82
to
86e5e64
Compare
sietseringers
force-pushed
the
shoulder-surf
branch
from
fec61e8
to
553e8a8
Compare
sietseringers
previously approved these changes
Oct 8, 2020
sietseringers
force-pushed
the
shoulder-surf
branch
from
bd8ae94
to
65efa46
Compare
ivard
changed the title
ivard
commented
Dec 3, 2020
sietseringers
force-pushed
the
shoulder-surf
branch
2 times, most recently
from
71a5629
to
73cf34c
Compare
… data in new FrontendSessionRequest struct
sietseringers
force-pushed
the
shoulder-surf
branch
from
8d26cf5
to
2b248d7
Compare
sietseringers
approved these changes
Jun 8, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Security feature to enable the frontend and the IRMA app to explicitly bind with each other. When binding is enabled a session will not immedialy start when the QR is scanned. The user first has to confirm in the frontend that the QR was scanned with the right device.
Announcement
In two weeks from now we will release version 0.8.0 of
irmago, including a new release of theirmaCLI tool, as well as version 0.4.0 ofirma-frontend. These versions introduces support for device pairing when starting an IRMA session by scanning a QR. In this way we prevent shoulder surfing attacks where someone in close physical proximity to the user scans a QR that was meant for the user.When an IRMA app with pairing support is used and pairing is enabled, users are asked to explicitly enter a pairing code after they scanned an IRMA QR. The IRMA app will show a 4 digit pairing code and the user is instructed to enter this pairing code on the device where the QR was shown. When the pairing code is correctly entered on the other device, the user is referred back to the IRMA app where the session continues as usual. When the user's IRMA app has no support for pairing yet, the pairing stage is skipped (for now). Support for pairing is expected to land in the beta channel of the IRMA app in a few weeks.
This feature can be enabled by your frontend library. Our library
irma-frontendversion0.4.0and higher will automatically enable this feature in cases where pairing is recommended (e.g. during issuance). You can change the default setting if you want, although we do not recommend relaxing the strictness of the default setting. In mobile sessions (when you don't have to scan a QR),irma-frontendwill never ask for a pairing code. If you implemented your own frontend library to handle your irma session, you can check here how to implement this yourself.This new
irmagoversion is fully backwards compatible with older versions ofirma-frontendandirmajs, so there is no requirement to update your website right away. When using older frontend versions, the IRMA session will simply be performed without a pairing stage. For issuers we do recommend to update your website as well to make the issuance of your attributes safer.Introducing pairing support forced us to make some changes in the public API of the
irmaserverlibrary and in the API ofirma-frontendused by plugins. For an overview of what changed inirmago, you can check the CHANGELOG. The outline of the new API can be found here. For an overview of what changed inirma-frontend, see the release notes.