MCB with Duo and password as fallback

[Cantor, Scott]

On 8/20/14, 10:20 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>You are correct, Scott. Initial contexts are used when the user doesn't
>yet have a session. So, that doesn't come into play for previous session
>handling. My point was simply that, in the case that a new user comes
>along, there seems to be a problem satisfying X if Y is allowed as an
>initial context but X isn't. Y gets satisfied, and the MCB runs with it.

Well, a problem in the strictest sense. In the more general sense the SP
did say password was ok, so the problem is in not getting the best you can
get, in exchange for more user convenience.

There's a valid case to be made that if you want something better, you
shouldn't accept something worse and expect not to get it. This is
exacerbated if the user has the ability to choose or to signal to the
strong method that they'd prefer the weak. Given a choice, I'm going to
pick the thing I don't have to pull out my phone for.

Strong auth basically doesn't work if you also allow weak, IMHO.

>Previous sessions are a different but somewhat similar situation. If the
>SP asks for X and Y and I already have a session with Y, the MCB again
>seems to run with it.

It's exactly the same situation; once you're past "initial", you have a
session and it operates the same for that SP as the next one. It certainly
ought to, anything else would be very confusing.

-- Scott