Re: [VoT] Vectors of Trust I-D feedback

[Jim Fenton <[e-mail]>]

On 8/3/15 11:12 PM, Rainer Hoerbe wrote:
> Am 04.08.2015 um 00:31 schrieb Jim Fenton <[e-mail]>:
>> To be entirely consistent with ISO/IEC 29115, we would need to rename Identity Proofing as Enrolment, and Credential Usage as Authentication.
>>
>> But ISO/IEC 29115 refers to these as phases: they occur at different times (or, in the case of Credential Management, over a long period of time) and have different threat models. But I would like to ask under which circumstances a Relying Party would act differently to an indication of less secure Credential Management vs. less secure Authentication.
> For a targeted attack the weak credential recovery will lower the adversary’s effort significantly, whereas in large numbers a 2F AuthN combined will still reduce the overall risk.

I have trouble understanding how an authentication with weak credential
recovery could ever be called two-factor.
>
>> There are credential management practices that would make a credential unsuitable for highly secure authentication, but why not just represent that as less secure authentication? VoT should be only as complex as required; it should not represent aspects of the process that the relying party does not need.
> +1. However, I remember a discussion at IIW where someone argued that an important use case for VoT is the combination of C4 (U2F) with  P1 (self-asserted) for social ids. But social networks are prioritizing usability over security with a weak recovery mechanism.

We need to make sure that it's clear to everyone that a recovery
mechanism is just another way of logging in, and if it's weaker than the
primary login method the authentication is weaker overall.

-Jim