Browser swapping attacks
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Quiet
- Domain
- authentication, security
Research direction
Start with the attached IETF 124 slides and the current FAPI2 attacker model. Analyse whether browser swapping attacks are covered, then document the conclusion and any required changes to the attacker model. Done means the attack and its treatment in FAPI2 are clearly recorded.
Written by the indexing model from the issue text.
Description
Originally submitted by josephheenan (Joseph Heenan) on 2025-11-03
A browser swapping attack was presented at IETF 124 today; slides attached.
We should analyse this, but this attacker might not be catered for in the FAPI2 attacker model.
Bitbucket status: open
Bitbucket origin: issue 843
- Dominant language
- HTML
- Stars
- 4
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openid/fapi
-
component: FAPI 1: Advanced migrated-from-bitbucket priority: major type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
migrated-from-bitbucket priority: trivial type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
component: Implementation & Deployment Advice
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
Similar issues
-
install: root SSH tmpfiles.d drop-in is labeled etc_runtime_t instead of etc_tPossibly taken @andrewdunndev claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
good first issue help wanted
Difficulty 1/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
security trivy
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kubefleet-dev/kubefleet#944 ·
Maintainers usually reply within 2 days
-
security-scan
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Show the mcp-gee-sweet auth hint for a mid-session RefreshError in tools that return error dictsOpenenhancement from-review
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
khuisman/mcp-gee-sweet#906 ·
Maintainers usually reply within 1 day