Security & testing notes
Demo defaults
- ≥256-bit capability tokens; request bodies Cache-Control: no-store
- Browser binding cookie required to finish login
- Session cookies only (no multi-week remember-me)
- HIGH authentication keys only; master/CRITICAL/transfer rejected
- Rate limits on create / fetch / respond / status / finish
Known residual risks (by design for MVP)
- QR forwarding: if someone else starts a real login and you approve their QR, their browser gets the session. Only approve logins you started.
- Simulator mode: does not talk to live Platform when verify mode is simulator-only.
- Account list: visible only when signed in (Dash names + identity IDs for transparency among testers; optional contact emails are obfuscated).
- Access policy is local: allowlist/bans live in this site’s database; they are not Dash Platform consensus rules.
Helpful attacks to try (demo only)
- Finish without the binding cookie
- Reuse a capability URL after expiry or after consume
- Respond twice; finish twice
- Sign with the wrong origin, network, or key level (simulator can help)
- Open the capability URL from a different browser than the one that created the request