{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/48","repository_url":"https://api.github.com/repos/OWASP/owasp-masvs","labels_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/48/comments","events_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/48/events","html_url":"https://github.com/OWASP/owasp-masvs/issues/48","id":185004894,"number":48,"title":"Insecure Communication Channels for Enrollment","user":{"login":"b-mueller","id":5194767,"avatar_url":"https://avatars.githubusercontent.com/u/5194767?v=3","gravatar_id":"","url":"https://api.github.com/users/b-mueller","html_url":"https://github.com/b-mueller","followers_url":"https://api.github.com/users/b-mueller/followers","following_url":"https://api.github.com/users/b-mueller/following{/other_user}","gists_url":"https://api.github.com/users/b-mueller/gists{/gist_id}","starred_url":"https://api.github.com/users/b-mueller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/b-mueller/subscriptions","organizations_url":"https://api.github.com/users/b-mueller/orgs","repos_url":"https://api.github.com/users/b-mueller/repos","events_url":"https://api.github.com/users/b-mueller/events{/privacy}","received_events_url":"https://api.github.com/users/b-mueller/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-10-25T02:44:05Z","updated_at":"2016-10-25T23:50:20Z","closed_at":null,"body":"Level 2, V5.5: \"Verify that the app doesn't rely on insecure communication channels (e.g email and SMS) for critical operations, such as enrollments and OTPs.\"\r\n\r\nSeems a bit harsh. An app I'm currently testing uses a combination of email and SMS to authenticate the user once during enrollment (= one OTP sent via SMS, another OTP via email, both have to be entered correctly). IMHO definitely secure enough to warrant a L2 verification.\r\n\r\nCan we soften this requirement somehow? Surely no app should rely solely on email OTP for 2FA, but there a scenario as described above should be acceptable?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/comments/256211913","html_url":"https://github.com/OWASP/owasp-masvs/issues/48#issuecomment-256211913","issue_url":"https://api.github.com/repos/OWASP/owasp-masvs/issues/48","id":256211913,"user":{"login":"sushi2k","id":5951320,"avatar_url":"https://avatars.githubusercontent.com/u/5951320?v=3","gravatar_id":"","url":"https://api.github.com/users/sushi2k","html_url":"https://github.com/sushi2k","followers_url":"https://api.github.com/users/sushi2k/followers","following_url":"https://api.github.com/users/sushi2k/following{/other_user}","gists_url":"https://api.github.com/users/sushi2k/gists{/gist_id}","starred_url":"https://api.github.com/users/sushi2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sushi2k/subscriptions","organizations_url":"https://api.github.com/users/sushi2k/orgs","repos_url":"https://api.github.com/users/sushi2k/repos","events_url":"https://api.github.com/users/sushi2k/events{/privacy}","received_events_url":"https://api.github.com/users/sushi2k/received_events","type":"User","site_admin":false},"created_at":"2016-10-25T23:50:20Z","updated_at":"2016-10-25T23:50:20Z","body":"The thing is SMS can be read by any App on an Android device if it has the rights for it (don't know how this is done on iOS in detail).  Would it make sense to rely here on GCM (Google Cloud Messaging) and iOS Push notifications instead? AFAIK this would at least ensure that only the App itself can read the message and it is encrypted in transit.\r\nOtherwise a combination like you mentioned might still be ok. But I would say this also depends on how long the  OTP or enrolment token is valid. If it's a minute I  it's not an issue if it's a day or even longer that's definitely an issue. "}}
{"actor":{"display_login":"sushi2k"}}