<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:11pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Rich Graves (when he's wearing his Carleton College hat as opposed to his St. Olaf College hat) is doing something along these lines. He presented at Internet2 TechEx last year about it, the slide deck [1] and blog post [2] have more information.</p>
<p><br>
</p>
<p>[1] <a href="https://docs.google.com/presentation/d/1shl6OUCUqH70_H7cFsc_q_K-YbgIIBLxeuOMzI_2vw8/edit#slide=id.g17666f3b03_0_0" class="x_OWAAutoLink" id="LPlnk927165">
https://docs.google.com/presentation/d/1shl6OUCUqH70_H7cFsc_q_K-YbgIIBLxeuOMzI_2vw8/edit#slide=id.g17666f3b03_0_0</a></p>
<p>[2] <a href="http://blogs.carleton.edu/rgraves/2016/07/15/tracking-your-own-location-to-improve-your-account-security/" class="x_OWAAutoLink" id="LPlnk511590">
http://blogs.carleton.edu/rgraves/2016/07/15/tracking-your-own-location-to-improve-your-account-security/</a><br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Philip Brusten <philip.brusten@kuleuven.be><br>
<b>Sent:</b> Tuesday, May 9, 2017 9:39:57 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Risk-based authN</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hi,<br>
<br>
we are thinking about making a service which collects information from <br>
trusted sources with information like: timestamp, application, userid, <br>
user-agent, browser-fingerprint, IP (+geo-ip), etc. We could then ask <br>
that service during a login to calculate the risk involved for that <br>
login (e.g. geo-distance, same browser, etc). If the IdP decides the <br>
risk is too high it could enforce multi-factor-authentication.<br>
<br>
If we could get enough assurance that the IdP session comes from the <br>
same user/browser, we could perhaps disable the consistentAddress-check, <br>
and elevate the authentication level when necessary.<br>
<br>
Is anyone doing the same thing?<br>
Are there any existing services out there which we could use?<br>
<br>
Kind regards,<br>
<br>
Philip<br>
<br>
<br>
-- <br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>