Browser swapping attacks
Open
Nobody has claimed this yet.
component: FAPI2: Security Profile
migrated-from-bitbucket
priority: major
type: bug
- Dominant language
- HTML
- Stars
- 3
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Originally submitted by josephheenan (Joseph Heenan) on 2025-11-03
A browser swapping attack was presented at IETF 124 today; slides attached.
We should analyse this, but this attacker might not be catered for in the FAPI2 attacker model.
Bitbucket status: open
Bitbucket origin: issue 843
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the attached IETF 124 slides and the current FAPI2 attacker model. Analyse whether browser swapping attacks are covered, then document the conclusion and any required changes to the attacker model. Done means the attack and its treatment in FAPI2 are clearly recorded.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100