MFA Interop Working Group

[Eric Goodman <>]

>Do not underestimate the other way around, for example a "second factor"
>mobile phone, with "first factor" password stored in login forms in the web 
>browser in the phone.
  
FWIW, we address this point without solving it. In the next two bullets after 
the ones I referred to, we say:

"Additionally, users can take actions that reduce the ability to treat 
otherwise independent factors as “independent”; for example, a user storing 
their software OTP generator on a network device accessible using just the 
“first factor” password. 

"The MFA profile does not enumerate specific requirements the institution 
must meet to protect against these forms of authentication dependence, but 
technical restrictions (where feasible) and user education are highly 
recommended to mitigate the risks of users deploying factors in a manner that 
decreases their independence."

Does that more or less addresses your concerns?

--- Eric