Internet Identity Lack Of Security

[plsak]

Hi, I wanted to start a topic Enhance security on identity.ic0.app but found this one and as it would be duplicated will just comment here.

Motivation: Users are supposed to properly secure their auth devices but at the same time are supposed to use them several times per day to access dApps, which are mutually exclusive requirements.

1. I agree with

   @LightningLad91

   What you are requesting is that II should only allow an existing seed phrase to be removed if the previous seed phrase is entered correctly first. By doing this you are giving the original owner the ability to recover the account even if one of their other authentication devices was compromised?

• This will allow owner of the Anchor to secure the passphrase and eventually use it as last resort recovery
  
  
  

2. I shared idea for had/dp type of device (hidden authorisation device/decreasing priority), but similar functionality seems covered by below proposal

• https://twitter.com/plsak/status/1470840499779031044?s=20
• Planned propsal:

  @maria

  Currently, all devices and recovery methods associated with a user’s identity anchor have the same level of privileges. In particular, each device or recovery method can be used to delete or add any other device or recovery methods.

  @maria

  In the future, Internet Identity shall support different privilege levels for different devices, allowing a user to designate certain devices or recovery methods as more trusted and, e.g., make them non-deletable by lower-level devices and methods.

• Note: this might seem to provide similar protection as hardening of seed-phrase change, but it’s actually more secure:
  • passphrase can be copied or memorised during the securing process and then misused
  • had/dp device(s) could be secured on different places (different banks safes) making it’s unauthorised access nearly impossible
    
    
    

3. Another convenient functionality would be to implement in Internet Identity option for 2FA setup

• with password (simpler) or some authenticator app
• https://twitter.com/CliffJumbo2/status/1471626182324269056?s=20
• https://twitter.com/plsak/status/1471775537249112064?s=20
• https://twitter.com/plsak/status/1471779932955201538?s=20
• In simplest scenario Anchor which has this activated will be able to choose (when doing auth with Internet Identity) if will use a single method/device - unprivileged access or 2FA - to get all privileges
  • II would provide response (with privileged status) to originating dApp which could then simply restrict it’s specific functions (NNS to move funds or start dissolving, II to remove devices etc.)
• with such setup could be even simple password login used for the unprivileged access
  • that could result in increased dApps usage - as for many the basic access would be easier