👟Step Up Authentication

What is step-up authentication and how does OTP Guard use it?

Step-up authentication is the process of requesting additional credentials before a high-risk operation, such as initiating a transaction - or in the case of OTP Guard, authorizing a Github pull request. OTP Guard is, at its core, a step-up authentication service for Github PRs.

The step-up credentials are usually a second authentication factor such as a TOTP code, but sites may sometimes ask for a password, email a special link, or similar.

In addition to the core mechanic of authorizing pull requests, OTP Guard uses step-up authentication to manage additional authenticators.

Adding and Deleting Authenticators on OTP Guard

The first authenticator registered for a Github organization on OTP Guard can be done immediately. Additional authenticators after the first will require a step-up with an existing authenticator. Any existing authenticator will work for the step-up. Likewise, deleting an authenticator will require a step-up. It is recommended to always have multiple authenticators registered, of different types, in case access is lost to one.

Step-up authentication dialog when registering a new security key.

The Cross-Device Problem: Stepping up with Platform Authenticators

Platform authenticators can be device-bound - meaning they exist only on the device they were created on. Device-bound authenticators present a challenge when trying to configure additional authenticators on different devices. How to step-up on a new device when the authenticator exists on another device? There are a few ways to work around this:

• Use a security key authenticator which can be swapped between devices.

• Use a TOTP code from a registered TOTP authenticator

• (Not yet implemented) Use the QR code UI that some browsers offer (such as Chrome), for hybrid authentication

• (Not yet implemented) Step-up on the old device, and generate an on-the-fly TOTP code that can be used on the new device

Losing access to an authenticator

If you have lost access to all your authenticators and are unable to step-up to create a new one, contact your Github organization administrator. They will have to delete all your existing authenticators, and then you can create a new one without having to step up.

Note that the administrator still has to step-up with an authenticator of their own in order to delete someone else's.