Currently, the only mechanism to receive remote attestation alerts is via e-mail. This can be problematic as some (perhaps even most) sign into their alert email on the device they are auditing with their remote attestation account. This would allow a compromised device to delete or suppress alert emails, or compromise the email account.
I propose adding a feature that would allow attestation.app to send alerts to the Auditor app. If you have multiple devices on an attestation.app account, there would be a checkbox/setting per-device to allow it to receive alert notifications.
The prerequisites are:
- A device must be added to an attestation.app account.
- There must be 2 or more devices added to the account.
- A device must be approved to receive these alert notifications in attestation.app
- A device must first provide a valid audit to attestation.app before the alert notifications are sent.
This would be in addition to email alerts, rather than replacing them, and multiple devices can be enrolled to receive these notifications in case one of the devices that gets alerts is compromised.
There should also be settings in Auditor to unenroll from these notifications and prohibit being re-enrolled in the future.
Currently, the only mechanism to receive remote attestation alerts is via e-mail. This can be problematic as some (perhaps even most) sign into their alert email on the device they are auditing with their remote attestation account. This would allow a compromised device to delete or suppress alert emails, or compromise the email account.
I propose adding a feature that would allow attestation.app to send alerts to the Auditor app. If you have multiple devices on an attestation.app account, there would be a checkbox/setting per-device to allow it to receive alert notifications.
The prerequisites are:
This would be in addition to email alerts, rather than replacing them, and multiple devices can be enrolled to receive these notifications in case one of the devices that gets alerts is compromised.
There should also be settings in Auditor to unenroll from these notifications and prohibit being re-enrolled in the future.