Assurance

[Josh Alexander <>]

>
##>I must be missing something. If there's mutual authentication (as
##>Jacob described earlier), then I see how MiTM is avoided, but how does
##>ordinary TLS client authentication prevent a MiTM from replaying to
##>the authentic IdP?

##There is mutual authentication. A TLS connection with certs on both ends
##involves proof of key possession by both endpoints that leads to the
##session key(s) used. The only risk is not waiting for that final state of
##affairs before sending data, but that's just an application flaw.

Scott and Tom,

I think I get what both of you are saying - but to Tom¹s previous question
- what if you could leverage social engineering and
convince/hassle/provoke a user to grant access (press ALLOW) for
un-authentic requests? Additionally, so far the conversation has been
steered toward MiTM attack vectors against MFA, but what about MiTB and
various endpoint attacks that happen post session authentication - what
are your thoughts as to if/how MFA can defend against these attacks behind
session auth?

Great thread BTW - just had to jump in and ask.

Thanks! 





-- 
Joshua D. Alexander


>