Working with a developer to update a login system through a web-UI:
Currently, we use:
- Enter login ID
- Goes through Challenge/Step-up
- Based on results: Challenge/Step-up User is presented the password page to login
They are wanting to change the flow to:
- Enter login ID
- User is immediately presented the password page
- Goes through Challenge/Step-up
The second scenario appears backward and vulnerable to attacks.
I need to look for something that corroborates this from an compliance/regulatory standpoint.