{"action":"created","issue":{"url":"https://api.github.com/repos/usnistgov/800-63-3/issues/16","repository_url":"https://api.github.com/repos/usnistgov/800-63-3","labels_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/16/comments","events_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/16/events","html_url":"https://github.com/usnistgov/800-63-3/issues/16","id":155083884,"number":16,"title":"Guidance for determining threshold for system users that KBV questions should be applied to for ID Proofing","user":{"login":"SES-SSE","id":19271135,"avatar_url":"https://avatars.githubusercontent.com/u/19271135?v=3","gravatar_id":"","url":"https://api.github.com/users/SES-SSE","html_url":"https://github.com/SES-SSE","followers_url":"https://api.github.com/users/SES-SSE/followers","following_url":"https://api.github.com/users/SES-SSE/following{/other_user}","gists_url":"https://api.github.com/users/SES-SSE/gists{/gist_id}","starred_url":"https://api.github.com/users/SES-SSE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SES-SSE/subscriptions","organizations_url":"https://api.github.com/users/SES-SSE/orgs","repos_url":"https://api.github.com/users/SES-SSE/repos","events_url":"https://api.github.com/users/SES-SSE/events{/privacy}","received_events_url":"https://api.github.com/users/SES-SSE/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/usnistgov/800-63-3/labels/-A","name":"-A","color":"d4c5f9"},{"url":"https://api.github.com/repos/usnistgov/800-63-3/labels/decline","name":"decline","color":"b60205"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-16T17:56:59Z","updated_at":"2016-06-01T18:27:02Z","closed_at":"2016-06-01T18:27:02Z","body":"**Organization**: 1\r\n \r\n**Reference (Include section and paragraph number)**:\r\n\r\n5.3.2. Knowledge Based Verification Requirements\r\n \r\n**Comment (Include rationale for comment)**:\r\n\r\nThe focus of identity proofing should not only be on the odds on creating a given fraudulent account for an individual, but should also include the odds of attacking the identity proofing capability of a system.  In the context of attacking the entire user base using random answers, KBV could lead to successful compromise of the identity verification steps for IAL 2 and 3.\r\n \r\n**Suggested Change**:\r\n\r\nThresholds of users should be determined when the probability of compromise of KBV doesn’t support the use of KBV.  In cases where KBV must be used irrespective of user population, then compensating controls such as micro-deposits or sending a letter in the mail to the user’s official home of record shall be used.\r\n \r\n---\r\n \r\nOrganization: 1 = Federal, 2 = Industry, 3 = Other \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/usnistgov/800-63-3/issues/comments/223082516","html_url":"https://github.com/usnistgov/800-63-3/issues/16#issuecomment-223082516","issue_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/16","id":223082516,"user":{"login":"pgrassi-nist","id":13986911,"avatar_url":"https://avatars.githubusercontent.com/u/13986911?v=3","gravatar_id":"","url":"https://api.github.com/users/pgrassi-nist","html_url":"https://github.com/pgrassi-nist","followers_url":"https://api.github.com/users/pgrassi-nist/followers","following_url":"https://api.github.com/users/pgrassi-nist/following{/other_user}","gists_url":"https://api.github.com/users/pgrassi-nist/gists{/gist_id}","starred_url":"https://api.github.com/users/pgrassi-nist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pgrassi-nist/subscriptions","organizations_url":"https://api.github.com/users/pgrassi-nist/orgs","repos_url":"https://api.github.com/users/pgrassi-nist/repos","events_url":"https://api.github.com/users/pgrassi-nist/events{/privacy}","received_events_url":"https://api.github.com/users/pgrassi-nist/received_events","type":"User","site_admin":false},"created_at":"2016-06-01T18:27:02Z","updated_at":"2016-06-01T18:27:02Z","body":"We prefer micro-deposit (it is  SHOULD in the KBV section) over KBV (which is a MAY).  In addition, we also require address confirmation based on records, to include notification to postal address."}}
{"actor":{"display_login":"pgrassi-nist"}}