View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011976 | Taler | merchant portal webui | public | 2026-11-09 08:43 | 2026-11-09 08:51 |
| Reporter | oec | Assigned To | Resolution deadline | ||
| Implementer | oec | Reviewer | |||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | CM_7 | |||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | low | Severity | feature | Reproducibility | have not tried |
| Status | planning | Resolution | open | ||
| Summary | 0011976: Add DD for support for phishing resistant login methods | ||||
| Description | We now have MFA in the webui, which helps to contain certain attacks, but is both cumbersome, may fail (mail blockage) and is not resistant against phishing. Instead, WebAuthn Level 3 et al. are by now widely supported in browsers, and we should consider to add support for passkeys. If this issue gets accepted, I would go ahead and write a Design Document for adding such support, including a discussion of pro's and con's, relevant technical resources, affected systems, etc.. Note that adding such support affects not only the UI-component (SPA) but the backend, too. | ||||
| Tags | No tags attached. | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-11-09 08:43 | oec | New Issue | |
| 2026-11-09 08:51 | Christian Grothoff | Implementer | => oec |
| 2026-11-09 08:51 | Christian Grothoff | Priority | normal => low |
| 2026-11-09 08:51 | Christian Grothoff | Status | new => planning |