Presentation by Firebase and DT on NumberVerification at ASAC WG meeting

[AxelNennker]

Hello,

Firebase PM, Micah Baker, and DT, Axel Nennker, gave a presentation on Firebase Phone Number Verification powered by Carriers.
There was very good attendance of 80 people.

The slides are here:
https://cryptpad.fr/presentation/#/2/presentation/view/s-2TJ3e3gJmGLJ0OV5WKFDgAekPoZz56KFCmZt3XwEA/

TL;DR:

• standards are needed

  • CAMARA is one of them.
    We are using CAMARA JWT Bearer Flow.
    https://github.com/camaraproject/IdentityAndConsentManagement/blob/main/documentation/CAMARA-Security-Interoperability.md#jwt-bearer-flow
    https://github.com/camaraproject/IdentityAndConsentManagement/blob/main/documentation/CAMARA-API-access-and-user-consent.md#jwt-bearer-flow

    If you are an API Provider then implement JWT Bearer Flow in your authorization server.

  • TS.43 defines the Entitlement Configuration Server
    If your are an API Provider then get a Entitlement Server - you want that anyway for e.g. eSim profile transfer
    If you already have an ECS, then talk the that team about AcquireTemporaryToken, GetPhoneNumber, ... and AcquireOperatorToken

The standard to trigger getting a Digital Credential from a website is Digital Credentials (openid4vp) by the OpenId Foundation ensuring that this can be used on the web and on mobile platforms that support W3C webauthn and digital credentials.

For questions on Firebase Phone Number Verification please contact Johanna Kollar(johkollar@google.com) or me (axel.nennker@telekom.de).

kind regards
Axel

[pendula95]

Thank you for sharing this @AxelNennker

I have a question regarding consent management. As far as I am aligned consent is collected and managed by Google.

https://github.com/camaraproject/IdentityAndConsentManagement/blob/main/documentation/CAMARA-API-access-and-user-consent.md#jwt-bearer-flow
As shown on the diagram Oauth2/OIDC server that is exposing the CAMARA APIs should be able to get consent data from the Consent Master.
In this case Google is the Consent Master?
Are there any specification or implementations details/hints on how this checking of the consent is done with Google?

Because it is clearly stated:

If required by the applicable legal basis, the Authorization Server MUST check the User's consent to the client for the requested Purpose and scopes.

• The request SHALL be rejected by the Authorization Server if the subject has not given consent (or opted-out) to the client for the requested Purpose and scopes.

https://github.com/camaraproject/IdentityAndConsentManagement/blob/373ca187512c3d85775047edac93efa883db28af/documentation/CAMARA-Security-Interoperability.md?plain=1#L265

[kwokonn-looi]

Thanks for sharing @AxelNennker.
The presentation mentioned that the end users are not required to enter their number, and the flows imply calling the CAMARA NV /device-phone-number endpoint. If the phone number is returned all the way to the end user's device;
(i) does that mean that no number verification is actually done by the API consumer? And does Android depend on the returned number to indicate the user's actual number (assuming this is not available from the SIM)?
(ii) will this user experience on Android be "standard" across all APPs? Or will APPs get to customize it such that users may be required to enter their number, and the API consumer may call the /verify endpoint instead?

Thanks,
Looi