The phone as my second factor: approve sign-ins and step-up with a fingerprint issue #32
closed: completed andymccall opened this · 0 comments
andymccall
The phone as my second factor (the hub side is oxygenhub#356):
Register the phone as an authenticator from Account: a P-256 key made in the Android Keystore, usable only after a fingerprint or face check (or the device PIN), its public half registered with the hub.
Approve sign-ins: signing in on the web pushes "Is this you?" to the phone over the sealed alert channel (issue #16) with the number the web page shows; I pick the matching number and confirm with a fingerprint, and the phone signs the hub's challenge. Deny reports it.
Step-up in the app: when the hub says an action needs a fresh second factor (landing into a protected bookmark, approving a run that needs it, an admin change), the app asks for the fingerprint and signs the challenge, then retries the action.
TOTP stays as the fallback for when the phone is not to hand; recovery codes as today.
Tests for the challenge signing and the number match; nothing secret leaves the Keystore.
The phone as my second factor (the hub side is oxygenhub#356):