Federation - Masking of Sensitive Information for Subscriber Privacy, v1.0

Identity Providers must by default mask sensitive data (e.g. passwords) displayed to the subscriber, although it SHALL allow users to unmask such values if they subscriber so chooses.

Assessment Step

Mask Sensitive Data (MaskSensitiveData)
Does the IdP properly mask sensitive data by default, while allowing the user to unmask it as needed?
Provide evidence (e.g. policies, operational samples, screenshots) that IdPs mask data correctly while allowing users to unmask the data as needed.

Conformance Criteria (1)

  • To mitigate the risk of unauthorized exposure of sensitive information (e.g., shoulder surfing), the IdP SHALL, by default, mask sensitive information displayed to the subscriber.
  • The IdP SHALL provide mechanisms for the subscriber to temporarily unmask such information in order for the subscriber to view full values.
NIST SP 800-63C
Section 4.2, Paragraph 5