Introducing CIBA for Secure Transaction Verification

Summary

CIBA addresses identity verification when an application cannot use an interactive login on the consumption device, including bank customer-service changes, retail POS payments, browser-constrained devices, and shared kiosks. Client-Initiated Backchannel Authentication decouples authentication from the application: a client sends a back-channel request to an OAuth 2.0 authorization provider, while the user approves it on a separately enrolled phone or smartwatch. CIBA extends OpenID Connect with a grant type, discovery metadata, and poll, ping, and push token-delivery modes; in the described banking flow, the application receives a user-scoped token to update the email address. The approach improves least-privilege access and avoids exposing credentials on shared devices, but can enable MFA-fatigue-style attacks, should not be used same-device, and may warrant device code flow in some cases.

Takeaways

1. 1

   CIBA defines three token-delivery modes: poll, where the client repeatedly checks for completion; ping, where the provider notifies a registered client URL; and push, where the provider sends tokens to that URL.

2. 2

   The banking email-update flow uses a push notification to a separately enrolled phone or smartwatch, followed by a user-scoped token that lets the customer-care application complete the update.

3. 3

   CIBA can be abused through repeated unsolicited authorization prompts resembling MFA-fatigue attacks; the source recommends considering device code flow in some cases and avoiding same-device use.