{"action":"closed","issue":{"url":"https://api.github.com/repos/stpilon/comment-matrix/issues/61","repository_url":"https://api.github.com/repos/stpilon/comment-matrix","labels_url":"https://api.github.com/repos/stpilon/comment-matrix/issues/61/labels{/name}","comments_url":"https://api.github.com/repos/stpilon/comment-matrix/issues/61/comments","events_url":"https://api.github.com/repos/stpilon/comment-matrix/issues/61/events","html_url":"https://github.com/stpilon/comment-matrix/issues/61","id":212489401,"number":61,"title":"Status of smartphone as something you have ","user":{"login":"dig-comments","id":25691591,"avatar_url":"https://avatars3.githubusercontent.com/u/25691591?v=3","gravatar_id":"","url":"https://api.github.com/users/dig-comments","html_url":"https://github.com/dig-comments","followers_url":"https://api.github.com/users/dig-comments/followers","following_url":"https://api.github.com/users/dig-comments/following{/other_user}","gists_url":"https://api.github.com/users/dig-comments/gists{/gist_id}","starred_url":"https://api.github.com/users/dig-comments/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dig-comments/subscriptions","organizations_url":"https://api.github.com/users/dig-comments/orgs","repos_url":"https://api.github.com/users/dig-comments/repos","events_url":"https://api.github.com/users/dig-comments/events{/privacy}","received_events_url":"https://api.github.com/users/dig-comments/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-03-07T16:41:54Z","updated_at":"2017-03-07T20:21:40Z","closed_at":"2017-03-07T20:21:40Z","body":"**Organization Name (N/A, if individual)**: Test Org\n\n**Organization Type**: 1\n \n**Document (63-3, 63A, 63B, or 63C)**: 800-63-3\n\n**Reference (Include section and paragraph number)**: 5.2.3, 4.1\n \n**Comment (Include rationale for comment)**:  Status of smartphone as something you have\n \nA smartphone held in our hand apparently belongs to \"something we have\". In view of this observation NIST could define the status of a smartphone with a biometric authentication in terms of the requirement of \"Biometrics SHALL be used with another authentication factor (something you have)\".\n\nWhere we are making a login into a service on the network from such a smartphone, it might be possible to interpret that the said requirement is satisfied. But NIST may have a different view.\n\nIt is hard, however, to apply such interpretation to the situation where we are making an unlocking login into the very smartphone. But NIST may have a different view.\n\nRemark: This suggestion has nothing to do with the fact that a smartphone equipped with biometrics authentication and a fallback password authentication as a recovery mechanism is obviously less secure than a smartphone with only a pincode authentication due to the larger attack surface.\n\n**Suggested Change**: For clarity's sake NIST could expressly define the status of a smartphone with a biometric authentication in terms of the requirement of \"Biometrics SHALL be used with another authentication factor (something you have)\", both where we are making a login into a service on the network from the smartphone and where we are making an unlock login into the very smartphone.\n \n---\n \nOrganization Type: 1 = Federal, 2 = Industry, 3 = Academia, 4 = Self, 5 = Other"}}
{"actor":{"display_login":"dig-comments"}}