6:09 p.m.
Hi,
I was wondering if we can support device registration and verification during login as
follows:
1) Users can enable/disable behavior in admin console for a specific realm.
2) After a successful login, KC checks if the user's device is known. For
instance, Browser and Operating System.
3) If not recognized, KC shows a page asking user if he wants to enable the
device.
4) KC sends an email to user with a code.
5) When trying to login again, user must provide the code to register the new
device and get authenticated.
6) For now on, users can authenticate without asking for permission if using the
same device.
Any thoughts ?
Regards.
Pedro Igor
1:35 a.m.
That might be nice feature. Maybe it may be also good to support
different authentication methods depending on the device? For example
require kerberos login when user loggs through his laptop, and password
authentication when login through mobile phone etc.
Marek
On 9.1.2015 00:09, Pedro Igor Silva wrote:
Hi,
I was wondering if we can support device registration and verification during login
as follows:
1) Users can enable/disable behavior in admin console for a specific realm.
2) After a successful login, KC checks if the user's device is known. For
instance, Browser and Operating System.
3) If not recognized, KC shows a page asking user if he wants to enable the
device.
4) KC sends an email to user with a code.
5) When trying to login again, user must provide the code to register the new
device and get authenticated.
6) For now on, users can authenticate without asking for permission if using the
same device.
Any thoughts ?
Regards.
Pedro Igor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
6:51 a.m.
+1.
Another thing to keep in mind is support for Adaptative/Multi Security Level. Wen can also
define levels based on the authc mechanism, user device, network, etc.
----- Original Message -----
From: "Marek Posolda" <mposolda(a)redhat.com>
To: "Pedro Igor Silva" <psilva(a)redhat.com>, "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
Sent: Friday, January 9, 2015 4:35:28 AM
Subject: Re: [keycloak-dev] Device registration and verification
That might be nice feature. Maybe it may be also good to support
different authentication methods depending on the device? For example
require kerberos login when user loggs through his laptop, and password
authentication when login through mobile phone etc.
Marek
On 9.1.2015 00:09, Pedro Igor Silva wrote:
Hi,
I was wondering if we can support device registration and verification during login
as follows:
1) Users can enable/disable behavior in admin console for a specific realm.
2) After a successful login, KC checks if the user's device is known. For
instance, Browser and Operating System.
3) If not recognized, KC shows a page asking user if he wants to enable the
device.
4) KC sends an email to user with a code.
5) When trying to login again, user must provide the code to register the new
device and get authenticated.
6) For now on, users can authenticate without asking for permission if using the
same device.
Any thoughts ?
Regards.
Pedro Igor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
2:02 a.m.
Requiring email seems unnecessary and awkward to me. The normal flow I've seen (at
least on Android) is that you simply login with your username and password on the device.
You can then go into your account later and list devices that are registered.
IMO we need to have a bigger discussion on how mobile and devices which includes the
AeroGear guys.
----- Original Message -----
From: "Pedro Igor Silva" <psilva(a)redhat.com>
To: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
Sent: Friday, 9 January, 2015 12:09:47 AM
Subject: [keycloak-dev] Device registration and verification
Hi,
I was wondering if we can support device registration and verification
during login as follows:
1) Users can enable/disable behavior in admin console for a specific
realm.
2) After a successful login, KC checks if the user's device is known.
For instance, Browser and Operating System.
3) If not recognized, KC shows a page asking user if he wants to
enable the device.
4) KC sends an email to user with a code.
5) When trying to login again, user must provide the code to register
the new device and get authenticated.
6) For now on, users can authenticate without asking for permission if
using the same device.
Any thoughts ?
Regards.
Pedro Igor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
6:44 a.m.
----- Original Message -----
From: "Stian Thorgersen" <stian(a)redhat.com>
To: "Pedro Igor Silva" <psilva(a)redhat.com>
Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
Sent: Friday, January 9, 2015 5:02:16 AM
Subject: Re: [keycloak-dev] Device registration and verification
Requiring email seems unnecessary and awkward to me. The normal flow I've
seen (at least on Android) is that you simply login with your username and
password on the device. You can then go into your account later and list
devices that are registered.
I was thinking more about browser-based scenarios. Mobile behaves differently but
similary. In any case, the idea is secure user account based on the devices he usually use
to access something. If that changes, it might be a threat.
IMO we need to have a bigger discussion on how mobile and devices which
includes the AeroGear guys.
----- Original Message -----
> From: "Pedro Igor Silva" <psilva(a)redhat.com>
> To: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> Sent: Friday, 9 January, 2015 12:09:47 AM
> Subject: [keycloak-dev] Device registration and verification
>
> Hi,
>
> I was wondering if we can support device registration and verification
> during login as follows:
>
> 1) Users can enable/disable behavior in admin console for a specific
> realm.
> 2) After a successful login, KC checks if the user's device is
> known.
> For instance, Browser and Operating System.
> 3) If not recognized, KC shows a page asking user if he wants to
> enable the device.
> 4) KC sends an email to user with a code.
> 5) When trying to login again, user must provide the code to
> register
> the new device and get authenticated.
> 6) For now on, users can authenticate without asking for permission
> if
> using the same device.
>
> Any thoughts ?
>
> Regards.
> Pedro Igor
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
8:29 a.m.
----- Original Message -----
From: "Pedro Igor Silva" <psilva(a)redhat.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
Sent: Friday, 9 January, 2015 12:44:20 PM
Subject: Re: [keycloak-dev] Device registration and verification
----- Original Message -----
> From: "Stian Thorgersen" <stian(a)redhat.com>
> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> Sent: Friday, January 9, 2015 5:02:16 AM
> Subject: Re: [keycloak-dev] Device registration and verification
>
> Requiring email seems unnecessary and awkward to me. The normal flow I've
> seen (at least on Android) is that you simply login with your username and
> password on the device. You can then go into your account later and list
> devices that are registered.
I was thinking more about browser-based scenarios. Mobile behaves differently
but similary. In any case, the idea is secure user account based on the
devices he usually use to access something. If that changes, it might be a
threat.
Sure, but what you're actually talking about here is using email as a 2nd factor
authentication right?
My plan was that we'd have more ways to do 2nd factor auth (sms, email, google
authenticator, yubikey, custom) and have an option on a realm to enable
"trusted" devices. If the realm has trusted devices enabled then the user only
has to use the 2nd factor authentication say every 30 days or so.
>
> IMO we need to have a bigger discussion on how mobile and devices which
> includes the AeroGear guys.
>
> ----- Original Message -----
> > From: "Pedro Igor Silva" <psilva(a)redhat.com>
> > To: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > Sent: Friday, 9 January, 2015 12:09:47 AM
> > Subject: [keycloak-dev] Device registration and verification
> >
> > Hi,
> >
> > I was wondering if we can support device registration and verification
> > during login as follows:
> >
> > 1) Users can enable/disable behavior in admin console for a
> > specific
> > realm.
> > 2) After a successful login, KC checks if the user's device is
> > known.
> > For instance, Browser and Operating System.
> > 3) If not recognized, KC shows a page asking user if he wants to
> > enable the device.
> > 4) KC sends an email to user with a code.
> > 5) When trying to login again, user must provide the code to
> > register
> > the new device and get authenticated.
> > 6) For now on, users can authenticate without asking for
> > permission
> > if
> > using the same device.
> >
> > Any thoughts ?
> >
> > Regards.
> > Pedro Igor
> >
> > _______________________________________________
> > keycloak-dev mailing list
> > keycloak-dev(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-dev
> >
>
10:09 a.m.
----- Original Message -----
From: "Stian Thorgersen" <stian(a)redhat.com>
To: "Pedro Igor Silva" <psilva(a)redhat.com>
Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
Sent: Friday, January 9, 2015 11:29:01 AM
Subject: Re: [keycloak-dev] Device registration and verification
----- Original Message -----
> From: "Pedro Igor Silva" <psilva(a)redhat.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> Sent: Friday, 9 January, 2015 12:44:20 PM
> Subject: Re: [keycloak-dev] Device registration and verification
>
> ----- Original Message -----
> > From: "Stian Thorgersen" <stian(a)redhat.com>
> > To: "Pedro Igor Silva" <psilva(a)redhat.com>
> > Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > Sent: Friday, January 9, 2015 5:02:16 AM
> > Subject: Re: [keycloak-dev] Device registration and verification
> >
> > Requiring email seems unnecessary and awkward to me. The normal flow I've
> > seen (at least on Android) is that you simply login with your username
> > and
> > password on the device. You can then go into your account later and list
> > devices that are registered.
>
> I was thinking more about browser-based scenarios. Mobile behaves
> differently
> but similary. In any case, the idea is secure user account based on the
> devices he usually use to access something. If that changes, it might be a
> threat.
Sure, but what you're actually talking about here is using email as a 2nd
factor authentication right?
No. Email is not a 2nd factor authentication, but the code itself. Email is just how you
send the code and also how you alert the user that someone is trying to access his account
from a not recognized device. In this case, the code is just an "activation
code" (not an authentication code), we can even remove the code and just provide a
confirmation link, for instance.
This is not about authenticating users, but authorization. Allowing access only from
devices previously approved by the user. Let's say you usually access your bank from
your home computer. But for some reason, you need temporary access from a LAN house
computer. You probably don't want to allow access from LAN house computers later on.
My plan was that we'd have more ways to do 2nd factor auth (sms, email,
google authenticator, yubikey, custom) and have an option on a realm to
enable "trusted" devices. If the realm has trusted devices enabled then the
user only has to use the 2nd factor authentication say every 30 days or so.
What I'm proposing is another security layer, which can be used together with 2nd
factor authentication.
>
> >
> > IMO we need to have a bigger discussion on how mobile and devices which
> > includes the AeroGear guys.
> >
> > ----- Original Message -----
> > > From: "Pedro Igor Silva" <psilva(a)redhat.com>
> > > To: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > > Sent: Friday, 9 January, 2015 12:09:47 AM
> > > Subject: [keycloak-dev] Device registration and verification
> > >
> > > Hi,
> > >
> > > I was wondering if we can support device registration and
> > > verification
> > > during login as follows:
> > >
> > > 1) Users can enable/disable behavior in admin console for a
> > > specific
> > > realm.
> > > 2) After a successful login, KC checks if the user's device is
> > > known.
> > > For instance, Browser and Operating System.
> > > 3) If not recognized, KC shows a page asking user if he wants to
> > > enable the device.
> > > 4) KC sends an email to user with a code.
> > > 5) When trying to login again, user must provide the code to
> > > register
> > > the new device and get authenticated.
> > > 6) For now on, users can authenticate without asking for
> > > permission
> > > if
> > > using the same device.
> > >
> > > Any thoughts ?
> > >
> > > Regards.
> > > Pedro Igor
> > >
> > > _______________________________________________
> > > keycloak-dev mailing list
> > > keycloak-dev(a)lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-dev
> > >
> >
>
2:01 a.m.
----- Original Message -----
From: "Pedro Igor Silva" <psilva(a)redhat.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
Sent: Friday, 9 January, 2015 4:09:51 PM
Subject: Re: [keycloak-dev] Device registration and verification
----- Original Message -----
> From: "Stian Thorgersen" <stian(a)redhat.com>
> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> Sent: Friday, January 9, 2015 11:29:01 AM
> Subject: Re: [keycloak-dev] Device registration and verification
>
>
>
> ----- Original Message -----
> > From: "Pedro Igor Silva" <psilva(a)redhat.com>
> > To: "Stian Thorgersen" <stian(a)redhat.com>
> > Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > Sent: Friday, 9 January, 2015 12:44:20 PM
> > Subject: Re: [keycloak-dev] Device registration and verification
> >
> > ----- Original Message -----
> > > From: "Stian Thorgersen" <stian(a)redhat.com>
> > > To: "Pedro Igor Silva" <psilva(a)redhat.com>
> > > Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > > Sent: Friday, January 9, 2015 5:02:16 AM
> > > Subject: Re: [keycloak-dev] Device registration and verification
> > >
> > > Requiring email seems unnecessary and awkward to me. The normal flow
> > > I've
> > > seen (at least on Android) is that you simply login with your username
> > > and
> > > password on the device. You can then go into your account later and
> > > list
> > > devices that are registered.
> >
> > I was thinking more about browser-based scenarios. Mobile behaves
> > differently
> > but similary. In any case, the idea is secure user account based on the
> > devices he usually use to access something. If that changes, it might be
> > a
> > threat.
>
> Sure, but what you're actually talking about here is using email as a 2nd
> factor authentication right?
No. Email is not a 2nd factor authentication, but the code itself. Email is
just how you send the code and also how you alert the user that someone is
trying to access his account from a not recognized device. In this case, the
code is just an "activation code" (not an authentication code), we can even
remove the code and just provide a confirmation link, for instance.
This is not about authenticating users, but authorization. Allowing access
only from devices previously approved by the user. Let's say you usually
access your bank from your home computer. But for some reason, you need
temporary access from a LAN house computer. You probably don't want to allow
access from LAN house computers later on.
>
> My plan was that we'd have more ways to do 2nd factor auth (sms, email,
> google authenticator, yubikey, custom) and have an option on a realm to
> enable "trusted" devices. If the realm has trusted devices enabled then
the
> user only has to use the 2nd factor authentication say every 30 days or so.
What I'm proposing is another security layer, which can be used together with
2nd factor authentication.
I see no difference, except for implementation details
>
> >
> > >
> > > IMO we need to have a bigger discussion on how mobile and devices which
> > > includes the AeroGear guys.
> > >
> > > ----- Original Message -----
> > > > From: "Pedro Igor Silva" <psilva(a)redhat.com>
> > > > To: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > > > Sent: Friday, 9 January, 2015 12:09:47 AM
> > > > Subject: [keycloak-dev] Device registration and verification
> > > >
> > > > Hi,
> > > >
> > > > I was wondering if we can support device registration and
> > > > verification
> > > > during login as follows:
> > > >
> > > > 1) Users can enable/disable behavior in admin console for a
> > > > specific
> > > > realm.
> > > > 2) After a successful login, KC checks if the user's
device is
> > > > known.
> > > > For instance, Browser and Operating System.
> > > > 3) If not recognized, KC shows a page asking user if he wants
> > > > to
> > > > enable the device.
> > > > 4) KC sends an email to user with a code.
> > > > 5) When trying to login again, user must provide the code to
> > > > register
> > > > the new device and get authenticated.
> > > > 6) For now on, users can authenticate without asking for
> > > > permission
> > > > if
> > > > using the same device.
> > > >
> > > > Any thoughts ?
> > > >
> > > > Regards.
> > > > Pedro Igor
> > > >
> > > > _______________________________________________
> > > > keycloak-dev mailing list
> > > > keycloak-dev(a)lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-dev
> > > >
> > >
> >
>
10:06 a.m.
----- Original Message -----
From: "Stian Thorgersen" <stian(a)redhat.com>
To: "Pedro Igor Silva" <psilva(a)redhat.com>
Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
Sent: Monday, January 12, 2015 5:01:35 AM
Subject: Re: [keycloak-dev] Device registration and verification
----- Original Message -----
> From: "Pedro Igor Silva" <psilva(a)redhat.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> Sent: Friday, 9 January, 2015 4:09:51 PM
> Subject: Re: [keycloak-dev] Device registration and verification
>
> ----- Original Message -----
> > From: "Stian Thorgersen" <stian(a)redhat.com>
> > To: "Pedro Igor Silva" <psilva(a)redhat.com>
> > Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > Sent: Friday, January 9, 2015 11:29:01 AM
> > Subject: Re: [keycloak-dev] Device registration and verification
> >
> >
> >
> > ----- Original Message -----
> > > From: "Pedro Igor Silva" <psilva(a)redhat.com>
> > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > > Sent: Friday, 9 January, 2015 12:44:20 PM
> > > Subject: Re: [keycloak-dev] Device registration and verification
> > >
> > > ----- Original Message -----
> > > > From: "Stian Thorgersen" <stian(a)redhat.com>
> > > > To: "Pedro Igor Silva" <psilva(a)redhat.com>
> > > > Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> > > > Sent: Friday, January 9, 2015 5:02:16 AM
> > > > Subject: Re: [keycloak-dev] Device registration and verification
> > > >
> > > > Requiring email seems unnecessary and awkward to me. The normal flow
> > > > I've
> > > > seen (at least on Android) is that you simply login with your
> > > > username
> > > > and
> > > > password on the device. You can then go into your account later and
> > > > list
> > > > devices that are registered.
> > >
> > > I was thinking more about browser-based scenarios. Mobile behaves
> > > differently
> > > but similary. In any case, the idea is secure user account based on the
> > > devices he usually use to access something. If that changes, it might
> > > be
> > > a
> > > threat.
> >
> > Sure, but what you're actually talking about here is using email as a 2nd
> > factor authentication right?
>
> No. Email is not a 2nd factor authentication, but the code itself. Email is
> just how you send the code and also how you alert the user that someone is
> trying to access his account from a not recognized device. In this case,
> the
> code is just an "activation code" (not an authentication code), we can
even
> remove the code and just provide a confirmation link, for instance.
>
> This is not about authenticating users, but authorization. Allowing access
> only from devices previously approved by the user. Let's say you usually
> access your bank from your home computer. But for some reason, you need
> temporary access from a LAN house computer. You probably don't want to
> allow
> access from LAN house computers later on.
>
> >
> > My plan was that we'd have more ways to do 2nd factor auth (sms, email,
> > google authenticator, yubikey, custom) and have an option on a realm to
> > enable "trusted" devices. If the realm has trusted devices enabled
then
> > the
> > user only has to use the 2nd factor authentication say every 30 days or
> > so.
>
> What I'm proposing is another security layer, which can be used together
> with
> 2nd factor authentication.
I see no difference, except for implementation details
There is a difference. Usually you see this feature in bank sites. Or even in SalesForce
if you try it out. It helps providers to increase security by allowing access only from
devices authorized by the user. You can even not use 2nd factor authentication at all.
>
> >
> > >
> > > >
> > > > IMO we need to have a bigger discussion on how mobile and devices
> > > > which
> > > > includes the AeroGear guys.
> > > >
> > > > ----- Original Message -----
> > > > > From: "Pedro Igor Silva" <psilva(a)redhat.com>
> > > > > To: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
> > > > > Sent: Friday, 9 January, 2015 12:09:47 AM
> > > > > Subject: [keycloak-dev] Device registration and verification
> > > > >
> > > > > Hi,
> > > > >
> > > > > I was wondering if we can support device registration and
> > > > > verification
> > > > > during login as follows:
> > > > >
> > > > > 1) Users can enable/disable behavior in admin console for
a
> > > > > specific
> > > > > realm.
> > > > > 2) After a successful login, KC checks if the user's
device
> > > > > is
> > > > > known.
> > > > > For instance, Browser and Operating System.
> > > > > 3) If not recognized, KC shows a page asking user if he
> > > > > wants
> > > > > to
> > > > > enable the device.
> > > > > 4) KC sends an email to user with a code.
> > > > > 5) When trying to login again, user must provide the code
to
> > > > > register
> > > > > the new device and get authenticated.
> > > > > 6) For now on, users can authenticate without asking for
> > > > > permission
> > > > > if
> > > > > using the same device.
> > > > >
> > > > > Any thoughts ?
> > > > >
> > > > > Regards.
> > > > > Pedro Igor
> > > > >
> > > > > _______________________________________________
> > > > > keycloak-dev mailing list
> > > > > keycloak-dev(a)lists.jboss.org
> > > > > https://lists.jboss.org/mailman/listinfo/keycloak-dev
> > > > >
> > > >
> > >
> >
>
10:39 a.m.
On 1/12/2015 10:06 AM, Pedro Igor Silva wrote:
----- Original Message -----
> From: "Stian Thorgersen" <stian(a)redhat.com>
> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> Sent: Monday, January 12, 2015 5:01:35 AM
> Subject: Re: [keycloak-dev] Device registration and verification
>
>
>
> ----- Original Message -----
>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
>> To: "Stian Thorgersen" <stian(a)redhat.com>
>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>> Sent: Friday, 9 January, 2015 4:09:51 PM
>> Subject: Re: [keycloak-dev] Device registration and verification
>>
>> ----- Original Message -----
>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>> Sent: Friday, January 9, 2015 11:29:01 AM
>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>
>>>
>>>
>>> ----- Original Message -----
>>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>> Sent: Friday, 9 January, 2015 12:44:20 PM
>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>
>>>> ----- Original Message -----
>>>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>>> Sent: Friday, January 9, 2015 5:02:16 AM
>>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>>
>>>>> Requiring email seems unnecessary and awkward to me. The normal flow
>>>>> I've
>>>>> seen (at least on Android) is that you simply login with your
>>>>> username
>>>>> and
>>>>> password on the device. You can then go into your account later and
>>>>> list
>>>>> devices that are registered.
>>>>
>>>> I was thinking more about browser-based scenarios. Mobile behaves
>>>> differently
>>>> but similary. In any case, the idea is secure user account based on the
>>>> devices he usually use to access something. If that changes, it might
>>>> be
>>>> a
>>>> threat.
>>>
>>> Sure, but what you're actually talking about here is using email as a
2nd
>>> factor authentication right?
>>
>> No. Email is not a 2nd factor authentication, but the code itself. Email is
>> just how you send the code and also how you alert the user that someone is
>> trying to access his account from a not recognized device. In this case,
>> the
>> code is just an "activation code" (not an authentication code), we can
even
>> remove the code and just provide a confirmation link, for instance.
>>
>> This is not about authenticating users, but authorization. Allowing access
>> only from devices previously approved by the user. Let's say you usually
>> access your bank from your home computer. But for some reason, you need
>> temporary access from a LAN house computer. You probably don't want to
>> allow
>> access from LAN house computers later on.
>>
>>>
>>> My plan was that we'd have more ways to do 2nd factor auth (sms, email,
>>> google authenticator, yubikey, custom) and have an option on a realm to
>>> enable "trusted" devices. If the realm has trusted devices enabled
then
>>> the
>>> user only has to use the 2nd factor authentication say every 30 days or
>>> so.
>>
>> What I'm proposing is another security layer, which can be used together
>> with
>> 2nd factor authentication.
>
> I see no difference, except for implementation details
There is a difference. Usually you see this feature in bank sites. Or even in SalesForce
if you try it out. It helps providers to increase security by allowing access only from
devices authorized by the user. You can even not use 2nd factor authentication at all.
How is this different than a "remember me" button?
Bill
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:56 a.m.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Monday, January 12, 2015 1:39:35 PM
Subject: Re: [keycloak-dev] Device registration and verification
On 1/12/2015 10:06 AM, Pedro Igor Silva wrote:
> ----- Original Message -----
>> From: "Stian Thorgersen" <stian(a)redhat.com>
>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>> Sent: Monday, January 12, 2015 5:01:35 AM
>> Subject: Re: [keycloak-dev] Device registration and verification
>>
>>
>>
>> ----- Original Message -----
>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
>>> To: "Stian Thorgersen" <stian(a)redhat.com>
>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>> Sent: Friday, 9 January, 2015 4:09:51 PM
>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>
>>> ----- Original Message -----
>>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>> Sent: Friday, January 9, 2015 11:29:01 AM
>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>
>>>>
>>>>
>>>> ----- Original Message -----
>>>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
>>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>>> Sent: Friday, 9 January, 2015 12:44:20 PM
>>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>>
>>>>> ----- Original Message -----
>>>>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
>>>>>> Sent: Friday, January 9, 2015 5:02:16 AM
>>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
>>>>>>
>>>>>> Requiring email seems unnecessary and awkward to me. The normal
flow
>>>>>> I've
>>>>>> seen (at least on Android) is that you simply login with your
>>>>>> username
>>>>>> and
>>>>>> password on the device. You can then go into your account later
and
>>>>>> list
>>>>>> devices that are registered.
>>>>>
>>>>> I was thinking more about browser-based scenarios. Mobile behaves
>>>>> differently
>>>>> but similary. In any case, the idea is secure user account based on
the
>>>>> devices he usually use to access something. If that changes, it
might
>>>>> be
>>>>> a
>>>>> threat.
>>>>
>>>> Sure, but what you're actually talking about here is using email as
a
>>>> 2nd
>>>> factor authentication right?
>>>
>>> No. Email is not a 2nd factor authentication, but the code itself. Email
>>> is
>>> just how you send the code and also how you alert the user that someone
>>> is
>>> trying to access his account from a not recognized device. In this case,
>>> the
>>> code is just an "activation code" (not an authentication code), we
can
>>> even
>>> remove the code and just provide a confirmation link, for instance.
>>>
>>> This is not about authenticating users, but authorization. Allowing
>>> access
>>> only from devices previously approved by the user. Let's say you
usually
>>> access your bank from your home computer. But for some reason, you need
>>> temporary access from a LAN house computer. You probably don't want to
>>> allow
>>> access from LAN house computers later on.
>>>
>>>>
>>>> My plan was that we'd have more ways to do 2nd factor auth (sms,
email,
>>>> google authenticator, yubikey, custom) and have an option on a realm to
>>>> enable "trusted" devices. If the realm has trusted devices
enabled then
>>>> the
>>>> user only has to use the 2nd factor authentication say every 30 days or
>>>> so.
>>>
>>> What I'm proposing is another security layer, which can be used
together
>>> with
>>> 2nd factor authentication.
>>
>> I see no difference, except for implementation details
>
> There is a difference. Usually you see this feature in bank sites. Or even
> in SalesForce if you try it out. It helps providers to increase security
> by allowing access only from devices authorized by the user. You can even
> not use 2nd factor authentication at all.
>
How is this different than a "remember me" button?
"Remember me" will allow you to get authenticated. But if you provided only
temporary access from that device, you will not be able to proceed even with
"remember me" checked. However, if that device was approved for you and marked
as "trusted" you will be fine.
This is not about authentication, but authorization ....
Bill
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
11:04 a.m.
----- Original Message -----
From: "Pedro Igor Silva" <psilva(a)redhat.com>
To: "Bill Burke" <bburke(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Monday, January 12, 2015 1:56:49 PM
Subject: Re: [keycloak-dev] Device registration and verification
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Monday, January 12, 2015 1:39:35 PM
> Subject: Re: [keycloak-dev] Device registration and verification
>
>
>
> On 1/12/2015 10:06 AM, Pedro Igor Silva wrote:
> > ----- Original Message -----
> >> From: "Stian Thorgersen" <stian(a)redhat.com>
> >> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> >> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> >> Sent: Monday, January 12, 2015 5:01:35 AM
> >> Subject: Re: [keycloak-dev] Device registration and verification
> >>
> >>
> >>
> >> ----- Original Message -----
> >>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
> >>> To: "Stian Thorgersen" <stian(a)redhat.com>
> >>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> >>> Sent: Friday, 9 January, 2015 4:09:51 PM
> >>> Subject: Re: [keycloak-dev] Device registration and verification
> >>>
> >>> ----- Original Message -----
> >>>> From: "Stian Thorgersen" <stian(a)redhat.com>
> >>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> >>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> >>>> Sent: Friday, January 9, 2015 11:29:01 AM
> >>>> Subject: Re: [keycloak-dev] Device registration and verification
> >>>>
> >>>>
> >>>>
> >>>> ----- Original Message -----
> >>>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
> >>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
> >>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
> >>>>> Sent: Friday, 9 January, 2015 12:44:20 PM
> >>>>> Subject: Re: [keycloak-dev] Device registration and
verification
> >>>>>
> >>>>> ----- Original Message -----
> >>>>>> From: "Stian Thorgersen"
<stian(a)redhat.com>
> >>>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> >>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
> >>>>>> Sent: Friday, January 9, 2015 5:02:16 AM
> >>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
> >>>>>>
> >>>>>> Requiring email seems unnecessary and awkward to me. The
normal flow
> >>>>>> I've
> >>>>>> seen (at least on Android) is that you simply login with
your
> >>>>>> username
> >>>>>> and
> >>>>>> password on the device. You can then go into your account
later and
> >>>>>> list
> >>>>>> devices that are registered.
> >>>>>
> >>>>> I was thinking more about browser-based scenarios. Mobile
behaves
> >>>>> differently
> >>>>> but similary. In any case, the idea is secure user account
based on
> >>>>> the
> >>>>> devices he usually use to access something. If that changes, it
might
> >>>>> be
> >>>>> a
> >>>>> threat.
> >>>>
> >>>> Sure, but what you're actually talking about here is using
email as a
> >>>> 2nd
> >>>> factor authentication right?
> >>>
> >>> No. Email is not a 2nd factor authentication, but the code itself.
> >>> Email
> >>> is
> >>> just how you send the code and also how you alert the user that
someone
> >>> is
> >>> trying to access his account from a not recognized device. In this
> >>> case,
> >>> the
> >>> code is just an "activation code" (not an authentication
code), we can
> >>> even
> >>> remove the code and just provide a confirmation link, for instance.
> >>>
> >>> This is not about authenticating users, but authorization. Allowing
> >>> access
> >>> only from devices previously approved by the user. Let's say you
> >>> usually
> >>> access your bank from your home computer. But for some reason, you
need
> >>> temporary access from a LAN house computer. You probably don't want
to
> >>> allow
> >>> access from LAN house computers later on.
> >>>
> >>>>
> >>>> My plan was that we'd have more ways to do 2nd factor auth
(sms,
> >>>> email,
> >>>> google authenticator, yubikey, custom) and have an option on a
realm
> >>>> to
> >>>> enable "trusted" devices. If the realm has trusted
devices enabled
> >>>> then
> >>>> the
> >>>> user only has to use the 2nd factor authentication say every 30
days
> >>>> or
> >>>> so.
> >>>
> >>> What I'm proposing is another security layer, which can be used
> >>> together
> >>> with
> >>> 2nd factor authentication.
> >>
> >> I see no difference, except for implementation details
> >
> > There is a difference. Usually you see this feature in bank sites. Or
> > even
> > in SalesForce if you try it out. It helps providers to increase security
> > by allowing access only from devices authorized by the user. You can even
> > not use 2nd factor authentication at all.
> >
>
> How is this different than a "remember me" button?
"Remember me" will allow you to get authenticated. But if you provided only
temporary access from that device, you will not be able to proceed even with
"remember me" checked. However, if that device was approved for you and
marked as "trusted" you will be fine.
This is not about authentication, but authorization ....
Which can be also combined with IP-based restrictions.
>
> Bill
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
12:32 p.m.
On 1/12/2015 10:56 AM, Pedro Igor Silva wrote:
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Monday, January 12, 2015 1:39:35 PM
> Subject: Re: [keycloak-dev] Device registration and verification
>
>
>
> On 1/12/2015 10:06 AM, Pedro Igor Silva wrote:
>> ----- Original Message -----
>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>> Sent: Monday, January 12, 2015 5:01:35 AM
>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>
>>>
>>>
>>> ----- Original Message -----
>>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>> Sent: Friday, 9 January, 2015 4:09:51 PM
>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>
>>>> ----- Original Message -----
>>>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>>> Sent: Friday, January 9, 2015 11:29:01 AM
>>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>>
>>>>>
>>>>>
>>>>> ----- Original Message -----
>>>>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
>>>>>> Sent: Friday, 9 January, 2015 12:44:20 PM
>>>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>>>
>>>>>> ----- Original Message -----
>>>>>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>>>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
>>>>>>> Sent: Friday, January 9, 2015 5:02:16 AM
>>>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
>>>>>>>
>>>>>>> Requiring email seems unnecessary and awkward to me. The
normal flow
>>>>>>> I've
>>>>>>> seen (at least on Android) is that you simply login with
your
>>>>>>> username
>>>>>>> and
>>>>>>> password on the device. You can then go into your account
later and
>>>>>>> list
>>>>>>> devices that are registered.
>>>>>>
>>>>>> I was thinking more about browser-based scenarios. Mobile
behaves
>>>>>> differently
>>>>>> but similary. In any case, the idea is secure user account based
on the
>>>>>> devices he usually use to access something. If that changes, it
might
>>>>>> be
>>>>>> a
>>>>>> threat.
>>>>>
>>>>> Sure, but what you're actually talking about here is using email
as a
>>>>> 2nd
>>>>> factor authentication right?
>>>>
>>>> No. Email is not a 2nd factor authentication, but the code itself. Email
>>>> is
>>>> just how you send the code and also how you alert the user that someone
>>>> is
>>>> trying to access his account from a not recognized device. In this case,
>>>> the
>>>> code is just an "activation code" (not an authentication code),
we can
>>>> even
>>>> remove the code and just provide a confirmation link, for instance.
>>>>
>>>> This is not about authenticating users, but authorization. Allowing
>>>> access
>>>> only from devices previously approved by the user. Let's say you
usually
>>>> access your bank from your home computer. But for some reason, you need
>>>> temporary access from a LAN house computer. You probably don't want
to
>>>> allow
>>>> access from LAN house computers later on.
>>>>
>>>>>
>>>>> My plan was that we'd have more ways to do 2nd factor auth (sms,
email,
>>>>> google authenticator, yubikey, custom) and have an option on a realm
to
>>>>> enable "trusted" devices. If the realm has trusted devices
enabled then
>>>>> the
>>>>> user only has to use the 2nd factor authentication say every 30 days
or
>>>>> so.
>>>>
>>>> What I'm proposing is another security layer, which can be used
together
>>>> with
>>>> 2nd factor authentication.
>>>
>>> I see no difference, except for implementation details
>>
>> There is a difference. Usually you see this feature in bank sites. Or even
>> in SalesForce if you try it out. It helps providers to increase security
>> by allowing access only from devices authorized by the user. You can even
>> not use 2nd factor authentication at all.
>>
>
> How is this different than a "remember me" button?
"Remember me" will allow you to get authenticated. But if you provided only
temporary access from that device, you will not be able to proceed even with
"remember me" checked. However, if that device was approved for you and marked
as "trusted" you will be fine.
This is not about authentication, but authorization ....
Remember me is the same thing as authorizing your browser/machine.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
1 p.m.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: "Pedro Igor Silva" <psilva(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Monday, January 12, 2015 3:32:49 PM
Subject: Re: [keycloak-dev] Device registration and verification
On 1/12/2015 10:56 AM, Pedro Igor Silva wrote:
> ----- Original Message -----
>> From: "Bill Burke" <bburke(a)redhat.com>
>> To: keycloak-dev(a)lists.jboss.org
>> Sent: Monday, January 12, 2015 1:39:35 PM
>> Subject: Re: [keycloak-dev] Device registration and verification
>>
>>
>>
>> On 1/12/2015 10:06 AM, Pedro Igor Silva wrote:
>>> ----- Original Message -----
>>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>> Sent: Monday, January 12, 2015 5:01:35 AM
>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>
>>>>
>>>>
>>>> ----- Original Message -----
>>>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
>>>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
>>>>> Sent: Friday, 9 January, 2015 4:09:51 PM
>>>>> Subject: Re: [keycloak-dev] Device registration and verification
>>>>>
>>>>> ----- Original Message -----
>>>>>> From: "Stian Thorgersen" <stian(a)redhat.com>
>>>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
>>>>>> Sent: Friday, January 9, 2015 11:29:01 AM
>>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
>>>>>>
>>>>>>
>>>>>>
>>>>>> ----- Original Message -----
>>>>>>> From: "Pedro Igor Silva"
<psilva(a)redhat.com>
>>>>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
>>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
>>>>>>> Sent: Friday, 9 January, 2015 12:44:20 PM
>>>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
>>>>>>>
>>>>>>> ----- Original Message -----
>>>>>>>> From: "Stian Thorgersen"
<stian(a)redhat.com>
>>>>>>>> To: "Pedro Igor Silva"
<psilva(a)redhat.com>
>>>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
>>>>>>>> Sent: Friday, January 9, 2015 5:02:16 AM
>>>>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
>>>>>>>>
>>>>>>>> Requiring email seems unnecessary and awkward to me. The
normal flow
>>>>>>>> I've
>>>>>>>> seen (at least on Android) is that you simply login with
your
>>>>>>>> username
>>>>>>>> and
>>>>>>>> password on the device. You can then go into your
account later and
>>>>>>>> list
>>>>>>>> devices that are registered.
>>>>>>>
>>>>>>> I was thinking more about browser-based scenarios. Mobile
behaves
>>>>>>> differently
>>>>>>> but similary. In any case, the idea is secure user account
based on
>>>>>>> the
>>>>>>> devices he usually use to access something. If that changes,
it might
>>>>>>> be
>>>>>>> a
>>>>>>> threat.
>>>>>>
>>>>>> Sure, but what you're actually talking about here is using
email as a
>>>>>> 2nd
>>>>>> factor authentication right?
>>>>>
>>>>> No. Email is not a 2nd factor authentication, but the code itself.
>>>>> Email
>>>>> is
>>>>> just how you send the code and also how you alert the user that
someone
>>>>> is
>>>>> trying to access his account from a not recognized device. In this
>>>>> case,
>>>>> the
>>>>> code is just an "activation code" (not an authentication
code), we can
>>>>> even
>>>>> remove the code and just provide a confirmation link, for instance.
>>>>>
>>>>> This is not about authenticating users, but authorization. Allowing
>>>>> access
>>>>> only from devices previously approved by the user. Let's say
you
>>>>> usually
>>>>> access your bank from your home computer. But for some reason, you
need
>>>>> temporary access from a LAN house computer. You probably don't
want to
>>>>> allow
>>>>> access from LAN house computers later on.
>>>>>
>>>>>>
>>>>>> My plan was that we'd have more ways to do 2nd factor auth
(sms,
>>>>>> email,
>>>>>> google authenticator, yubikey, custom) and have an option on a
realm
>>>>>> to
>>>>>> enable "trusted" devices. If the realm has trusted
devices enabled
>>>>>> then
>>>>>> the
>>>>>> user only has to use the 2nd factor authentication say every 30
days
>>>>>> or
>>>>>> so.
>>>>>
>>>>> What I'm proposing is another security layer, which can be used
>>>>> together
>>>>> with
>>>>> 2nd factor authentication.
>>>>
>>>> I see no difference, except for implementation details
>>>
>>> There is a difference. Usually you see this feature in bank sites. Or
>>> even
>>> in SalesForce if you try it out. It helps providers to increase security
>>> by allowing access only from devices authorized by the user. You can even
>>> not use 2nd factor authentication at all.
>>>
>>
>> How is this different than a "remember me" button?
>
> "Remember me" will allow you to get authenticated. But if you provided
only
> temporary access from that device, you will not be able to proceed even
> with "remember me" checked. However, if that device was approved for you
> and marked as "trusted" you will be fine.
>
> This is not about authentication, but authorization ....
>
Remember me is the same thing as authorizing your browser/machine.
Yes. But you don't track the devices (or pcs), when was your last login from a device,
define how long you want to "remember" that device or if you just want a single
access from that computer,
receive notifications from access from unauthorized devices and so forth.
In a sense that is much more than just seamless authenticate (and authorize that computer)
the user.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
1:10 p.m.
----- Original Message -----
From: "Pedro Igor Silva" <psilva(a)redhat.com>
To: "Bill Burke" <bburke(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Monday, 12 January, 2015 7:00:10 PM
Subject: Re: [keycloak-dev] Device registration and verification
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> Cc: keycloak-dev(a)lists.jboss.org
> Sent: Monday, January 12, 2015 3:32:49 PM
> Subject: Re: [keycloak-dev] Device registration and verification
>
>
>
> On 1/12/2015 10:56 AM, Pedro Igor Silva wrote:
> > ----- Original Message -----
> >> From: "Bill Burke" <bburke(a)redhat.com>
> >> To: keycloak-dev(a)lists.jboss.org
> >> Sent: Monday, January 12, 2015 1:39:35 PM
> >> Subject: Re: [keycloak-dev] Device registration and verification
> >>
> >>
> >>
> >> On 1/12/2015 10:06 AM, Pedro Igor Silva wrote:
> >>> ----- Original Message -----
> >>>> From: "Stian Thorgersen" <stian(a)redhat.com>
> >>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> >>>> Cc: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
> >>>> Sent: Monday, January 12, 2015 5:01:35 AM
> >>>> Subject: Re: [keycloak-dev] Device registration and verification
> >>>>
> >>>>
> >>>>
> >>>> ----- Original Message -----
> >>>>> From: "Pedro Igor Silva" <psilva(a)redhat.com>
> >>>>> To: "Stian Thorgersen" <stian(a)redhat.com>
> >>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
> >>>>> Sent: Friday, 9 January, 2015 4:09:51 PM
> >>>>> Subject: Re: [keycloak-dev] Device registration and
verification
> >>>>>
> >>>>> ----- Original Message -----
> >>>>>> From: "Stian Thorgersen"
<stian(a)redhat.com>
> >>>>>> To: "Pedro Igor Silva" <psilva(a)redhat.com>
> >>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
> >>>>>> Sent: Friday, January 9, 2015 11:29:01 AM
> >>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> ----- Original Message -----
> >>>>>>> From: "Pedro Igor Silva"
<psilva(a)redhat.com>
> >>>>>>> To: "Stian Thorgersen"
<stian(a)redhat.com>
> >>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
> >>>>>>> Sent: Friday, 9 January, 2015 12:44:20 PM
> >>>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
> >>>>>>>
> >>>>>>> ----- Original Message -----
> >>>>>>>> From: "Stian Thorgersen"
<stian(a)redhat.com>
> >>>>>>>> To: "Pedro Igor Silva"
<psilva(a)redhat.com>
> >>>>>>>> Cc: "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
> >>>>>>>> Sent: Friday, January 9, 2015 5:02:16 AM
> >>>>>>>> Subject: Re: [keycloak-dev] Device registration and
verification
> >>>>>>>>
> >>>>>>>> Requiring email seems unnecessary and awkward to
me. The normal
> >>>>>>>> flow
> >>>>>>>> I've
> >>>>>>>> seen (at least on Android) is that you simply login
with your
> >>>>>>>> username
> >>>>>>>> and
> >>>>>>>> password on the device. You can then go into your
account later
> >>>>>>>> and
> >>>>>>>> list
> >>>>>>>> devices that are registered.
> >>>>>>>
> >>>>>>> I was thinking more about browser-based scenarios.
Mobile behaves
> >>>>>>> differently
> >>>>>>> but similary. In any case, the idea is secure user
account based on
> >>>>>>> the
> >>>>>>> devices he usually use to access something. If that
changes, it
> >>>>>>> might
> >>>>>>> be
> >>>>>>> a
> >>>>>>> threat.
> >>>>>>
> >>>>>> Sure, but what you're actually talking about here is
using email as
> >>>>>> a
> >>>>>> 2nd
> >>>>>> factor authentication right?
> >>>>>
> >>>>> No. Email is not a 2nd factor authentication, but the code
itself.
> >>>>> Email
> >>>>> is
> >>>>> just how you send the code and also how you alert the user
that
> >>>>> someone
> >>>>> is
> >>>>> trying to access his account from a not recognized device. In
this
> >>>>> case,
> >>>>> the
> >>>>> code is just an "activation code" (not an
authentication code), we
> >>>>> can
> >>>>> even
> >>>>> remove the code and just provide a confirmation link, for
instance.
> >>>>>
> >>>>> This is not about authenticating users, but authorization.
Allowing
> >>>>> access
> >>>>> only from devices previously approved by the user. Let's
say you
> >>>>> usually
> >>>>> access your bank from your home computer. But for some reason,
you
> >>>>> need
> >>>>> temporary access from a LAN house computer. You probably
don't want
> >>>>> to
> >>>>> allow
> >>>>> access from LAN house computers later on.
> >>>>>
> >>>>>>
> >>>>>> My plan was that we'd have more ways to do 2nd factor
auth (sms,
> >>>>>> email,
> >>>>>> google authenticator, yubikey, custom) and have an option
on a realm
> >>>>>> to
> >>>>>> enable "trusted" devices. If the realm has
trusted devices enabled
> >>>>>> then
> >>>>>> the
> >>>>>> user only has to use the 2nd factor authentication say
every 30 days
> >>>>>> or
> >>>>>> so.
> >>>>>
> >>>>> What I'm proposing is another security layer, which can be
used
> >>>>> together
> >>>>> with
> >>>>> 2nd factor authentication.
> >>>>
> >>>> I see no difference, except for implementation details
> >>>
> >>> There is a difference. Usually you see this feature in bank sites. Or
> >>> even
> >>> in SalesForce if you try it out. It helps providers to increase
> >>> security
> >>> by allowing access only from devices authorized by the user. You can
> >>> even
> >>> not use 2nd factor authentication at all.
> >>>
> >>
> >> How is this different than a "remember me" button?
> >
> > "Remember me" will allow you to get authenticated. But if you
provided
> > only
> > temporary access from that device, you will not be able to proceed even
> > with "remember me" checked. However, if that device was approved for
you
> > and marked as "trusted" you will be fine.
> >
> > This is not about authentication, but authorization ....
> >
>
> Remember me is the same thing as authorizing your browser/machine.
Yes. But you don't track the devices (or pcs), when was your last login from
a device, define how long you want to "remember" that device or if you just
want a single access from that computer,
receive notifications from access from unauthorized devices and so forth.
In a sense that is much more than just seamless authenticate (and authorize
that computer) the user.
I'm curious to see what you're proposing in a real system, but to me it sounds
like it's similar enough that a remember me and multi factor auth mechanism would have
the same level of security without complicating things for the user.
>
>
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
>
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
9:35 a.m.
On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
> In a sense that is much more than just seamless authenticate (and
authorize
> that computer) the user.
I'm curious to see what you're proposing in a real system, but to me it sounds
like it's similar enough that a remember me and multi factor auth mechanism would have
the same level of security without complicating things for the user.
I don't think we need any special device registration and verification
for users. Any type of client registration should be done by app devs,
not users.
For browsers, "remember me" and a persistent cookie is good enough. For
mobile and native apps, a refresh token can be stored. We should
probably have per-client overrides for things like access and refresh
token timeouts. We'll eventually add Client IP features so that a user
doesn't have to use 2-factor auth if they are logging in from the same
device from the same IP.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
9:37 a.m.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: "Stian Thorgersen" <stian(a)redhat.com>, "Pedro Igor Silva"
<psilva(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Tuesday, 13 January, 2015 3:35:18 PM
Subject: Re: [keycloak-dev] Device registration and verification
On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
>> In a sense that is much more than just seamless authenticate (and
>> authorize
>> that computer) the user.
>
> I'm curious to see what you're proposing in a real system, but to me it
> sounds like it's similar enough that a remember me and multi factor auth
> mechanism would have the same level of security without complicating
> things for the user.
>
I don't think we need any special device registration and verification
for users. Any type of client registration should be done by app devs,
not users.
For browsers, "remember me" and a persistent cookie is good enough. For
mobile and native apps, a refresh token can be stored. We should
probably have per-client overrides for things like access and refresh
token timeouts. We'll eventually add Client IP features so that a user
doesn't have to use 2-factor auth if they are logging in from the same
device from the same IP.
IMO not requiring 2-factor auth from same device should use a cookie not IP
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:10 a.m.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: "Stian Thorgersen" <stian(a)redhat.com>, "Pedro Igor Silva"
<psilva(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Tuesday, January 13, 2015 12:35:18 PM
Subject: Re: [keycloak-dev] Device registration and verification
On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
>> In a sense that is much more than just seamless authenticate (and
>> authorize
>> that computer) the user.
>
> I'm curious to see what you're proposing in a real system, but to me it
> sounds like it's similar enough that a remember me and multi factor auth
> mechanism would have the same level of security without complicating
> things for the user.
>
I don't think we need any special device registration and verification
for users. Any type of client registration should be done by app devs,
not users.
For browsers, "remember me" and a persistent cookie is good enough. For
mobile and native apps, a refresh token can be stored. We should
probably have per-client overrides for things like access and refresh
token timeouts. We'll eventually add Client IP features so that a user
doesn't have to use 2-factor auth if they are logging in from the same
device from the same IP.
My proposal is all based on browsers, people using their desktops. So you can have an
alias for a computer and use a cookie + IP (or even track information from the user-agent)
to support the features I suggested before. If IP changed or user is using a unrecognized
user-agent you notify the user. Sometimes this sucks, because your IP may change often
depending on your network, but I think it is a nice feature to have.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:26 a.m.
On 1/13/2015 10:10 AM, Pedro Igor Silva wrote:
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>, "Pedro Igor
Silva" <psilva(a)redhat.com>
> Cc: keycloak-dev(a)lists.jboss.org
> Sent: Tuesday, January 13, 2015 12:35:18 PM
> Subject: Re: [keycloak-dev] Device registration and verification
>
>
>
> On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
>>> In a sense that is much more than just seamless authenticate (and
>>> authorize
>>> that computer) the user.
>>
>> I'm curious to see what you're proposing in a real system, but to me it
>> sounds like it's similar enough that a remember me and multi factor auth
>> mechanism would have the same level of security without complicating
>> things for the user.
>>
>
> I don't think we need any special device registration and verification
> for users. Any type of client registration should be done by app devs,
> not users.
>
> For browsers, "remember me" and a persistent cookie is good enough. For
> mobile and native apps, a refresh token can be stored. We should
> probably have per-client overrides for things like access and refresh
> token timeouts. We'll eventually add Client IP features so that a user
> doesn't have to use 2-factor auth if they are logging in from the same
> device from the same IP.
My proposal is all based on browsers, people using their desktops. So you can have an
alias for a computer and use a cookie + IP (or even track information from the user-agent)
to support the features I suggested before. If IP changed or user is using a unrecognized
user-agent you notify the user. Sometimes this sucks, because your IP may change often
depending on your network, but I think it is a nice feature to have.
As long as there is no extra steps for the user, it is a fine idea. Same
goes for any special SPI. No new special SPIs for this type of thing.
For a long time I've wanted the ability to warn the user if there was a
login from rogue hacker nation. Countries and even states, counties and
cities are assigned specific IP address masks. I'm pretty sure ISPs are
assigned specific ones too. There's a free country IP database you can
download with the option to pay for more fine-grain information.
BTW, I already had this on my task list for a long time and really
wanted to do this work.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:41 a.m.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: "Pedro Igor Silva" <psilva(a)redhat.com>
Cc: "Stian Thorgersen" <stian(a)redhat.com>, keycloak-dev(a)lists.jboss.org
Sent: Tuesday, January 13, 2015 1:26:42 PM
Subject: Re: [keycloak-dev] Device registration and verification
On 1/13/2015 10:10 AM, Pedro Igor Silva wrote:
> ----- Original Message -----
>> From: "Bill Burke" <bburke(a)redhat.com>
>> To: "Stian Thorgersen" <stian(a)redhat.com>, "Pedro Igor
Silva"
>> <psilva(a)redhat.com>
>> Cc: keycloak-dev(a)lists.jboss.org
>> Sent: Tuesday, January 13, 2015 12:35:18 PM
>> Subject: Re: [keycloak-dev] Device registration and verification
>>
>>
>>
>> On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
>>>> In a sense that is much more than just seamless authenticate (and
>>>> authorize
>>>> that computer) the user.
>>>
>>> I'm curious to see what you're proposing in a real system, but to me
it
>>> sounds like it's similar enough that a remember me and multi factor
auth
>>> mechanism would have the same level of security without complicating
>>> things for the user.
>>>
>>
>> I don't think we need any special device registration and verification
>> for users. Any type of client registration should be done by app devs,
>> not users.
>>
>> For browsers, "remember me" and a persistent cookie is good enough.
For
>> mobile and native apps, a refresh token can be stored. We should
>> probably have per-client overrides for things like access and refresh
>> token timeouts. We'll eventually add Client IP features so that a user
>> doesn't have to use 2-factor auth if they are logging in from the same
>> device from the same IP.
>
> My proposal is all based on browsers, people using their desktops. So you
> can have an alias for a computer and use a cookie + IP (or even track
> information from the user-agent) to support the features I suggested
> before. If IP changed or user is using a unrecognized user-agent you
> notify the user. Sometimes this sucks, because your IP may change often
> depending on your network, but I think it is a nice feature to have.
>
As long as there is no extra steps for the user, it is a fine idea. Same
goes for any special SPI. No new special SPIs for this type of thing.
For a long time I've wanted the ability to warn the user if there was a
login from rogue hacker nation. Countries and even states, counties and
cities are assigned specific IP address masks. I'm pretty sure ISPs are
assigned specific ones too. There's a free country IP database you can
download with the option to pay for more fine-grain information.
BTW, I already had this on my task list for a long time and really
wanted to do this work.
Sure :)
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:22 a.m.
On 1/13/2015 9:35 AM, Bill Burke wrote:
On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
>> In a sense that is much more than just seamless authenticate (and authorize
>> that computer) the user.
> I'm curious to see what you're proposing in a real system, but to me it
sounds like it's similar enough that a remember me and multi factor auth mechanism
would have the same level of security without complicating things for the user.
>
I don't think we need any special device registration and verification
for users. Any type of client registration should be done by app devs,
not users.
For browsers, "remember me" and a persistent cookie is good enough. For
mobile and native apps, a refresh token can be stored. We should
probably have per-client overrides for things like access and refresh
token timeouts. We'll eventually add Client IP features so that a user
doesn't have to use 2-factor auth if they are logging in from the same
device from the same IP.
I can tell you what my bank does. I have the usual
login/remember me
function. But if I want to access something that is more sensitive than
my basic account balance and such, I need to authorize my device. This
is done by getting the bank to send me a code via email or text. I then
enter the code in the site and I'm issued a cookie so that the device
doesn't have to go through this process again.
So this is quite different from "remember me", which only applies to
authentication. If someone finds out my credentials they still can't
get high level authorization to my account without physical access to my
device.
IMO, it would be a nice feature to implement in keycloak so that app
devs don't have to.
10:42 a.m.
On 1/13/2015 10:22 AM, Stan Silvert wrote:
On 1/13/2015 9:35 AM, Bill Burke wrote:
>
> On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
>>> In a sense that is much more than just seamless authenticate (and authorize
>>> that computer) the user.
>> I'm curious to see what you're proposing in a real system, but to me it
sounds like it's similar enough that a remember me and multi factor auth mechanism
would have the same level of security without complicating things for the user.
>>
> I don't think we need any special device registration and verification
> for users. Any type of client registration should be done by app devs,
> not users.
>
> For browsers, "remember me" and a persistent cookie is good enough. For
> mobile and native apps, a refresh token can be stored. We should
> probably have per-client overrides for things like access and refresh
> token timeouts. We'll eventually add Client IP features so that a user
> doesn't have to use 2-factor auth if they are logging in from the same
> device from the same IP.
I can tell you what my bank does. I have the usual login/remember me
function. But if I want to access something that is more sensitive than
my basic account balance and such, I need to authorize my device. This
is done by getting the bank to send me a code via email or text. I then
enter the code in the site and I'm issued a cookie so that the device
doesn't have to go through this process again.
I would suggest the bank use OTP rather than this device registration
you talk of.
So this is quite different from "remember me", which only
applies to
authentication. If someone finds out my credentials they still can't
get high level authorization to my account without physical access to my
device.
This is no different than OTP. Hacker could find a user's password, but
they still need the OTP device to log in.
IMO, it would be a nice feature to implement in keycloak so that app
devs don't have to.
IMO, too many ways to do the same thing is not a good idea. App devs
should use OTP.
How you set up OTP is another separate matter. For example, World of
Warcraft has OTP. The OTP generator is set up *PER DEVICE*. So if you
lose your iphone, you have to call up Blizzard support and answer a
bunch of personal questions before they disable OTP. The other option
they have is for you to register your mobile number. So, if you lose
you iphone and get another, you can disable OTP through an SMS exchange
with your new iphone.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
2:53 a.m.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Tuesday, 13 January, 2015 4:42:07 PM
Subject: Re: [keycloak-dev] Device registration and verification
On 1/13/2015 10:22 AM, Stan Silvert wrote:
> On 1/13/2015 9:35 AM, Bill Burke wrote:
>>
>> On 1/12/2015 1:10 PM, Stian Thorgersen wrote:
>>>> In a sense that is much more than just seamless authenticate (and
>>>> authorize
>>>> that computer) the user.
>>> I'm curious to see what you're proposing in a real system, but to me
it
>>> sounds like it's similar enough that a remember me and multi factor
auth
>>> mechanism would have the same level of security without complicating
>>> things for the user.
>>>
>> I don't think we need any special device registration and verification
>> for users. Any type of client registration should be done by app devs,
>> not users.
>>
>> For browsers, "remember me" and a persistent cookie is good enough.
For
>> mobile and native apps, a refresh token can be stored. We should
>> probably have per-client overrides for things like access and refresh
>> token timeouts. We'll eventually add Client IP features so that a user
>> doesn't have to use 2-factor auth if they are logging in from the same
>> device from the same IP.
> I can tell you what my bank does. I have the usual login/remember me
> function. But if I want to access something that is more sensitive than
> my basic account balance and such, I need to authorize my device. This
> is done by getting the bank to send me a code via email or text. I then
> enter the code in the site and I'm issued a cookie so that the device
> doesn't have to go through this process again.
>
I would suggest the bank use OTP rather than this device registration
you talk of.
> So this is quite different from "remember me", which only applies to
> authentication. If someone finds out my credentials they still can't
> get high level authorization to my account without physical access to my
> device.
>
This is no different than OTP. Hacker could find a user's password, but
they still need the OTP device to log in.
> IMO, it would be a nice feature to implement in keycloak so that app
> devs don't have to.
IMO, too many ways to do the same thing is not a good idea. App devs
should use OTP.
How you set up OTP is another separate matter. For example, World of
Warcraft has OTP. The OTP generator is set up *PER DEVICE*. So if you
lose your iphone, you have to call up Blizzard support and answer a
bunch of personal questions before they disable OTP. The other option
they have is for you to register your mobile number. So, if you lose
you iphone and get another, you can disable OTP through an SMS exchange
with your new iphone.
There's also multi-level authentication. TOTP can be optional on a new device until
you're trying to do something sensitive. The app can then check the authentication
level provided for the specific token, if it's not high enough, redirect back to login
pages on Keycloak to bump the authentication level (totp, email or whatever).
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
3388
days inactive
3394
days old
22 comments
5 participants
participants (5)
-
Bill Burke -
Marek Posolda -
Pedro Igor Silva -
Stan Silvert -
Stian Thorgersen