Code change:
Changed name of "User transferred" attack to User Transferred Session Data Pattern - see Issue
Is this a duplicate with PR ?
Resolving issue
Resolving

Related discussion:
text: techniques to prime the user for an authorization request and thereby trick them into granting authorization.  The social engineering techniques range in sophistication from messages misrepresenting the <del> reason for receiving an authorization request to triggering a large </del> <ins> reason for receiving an authorization request, to triggering a large </ins> volume of requests at an inconvenient time for the user, in the hope that the user will grant authorization to make the requests stop. The figure below shows an example of such an attack. 3.3. <del> In cross-device flows that follow the Hybrid Pattern, the client initiates the authorization request, but the user still has to transfer the authorization code to the initiating device.  The authorization request may happen as a result of user interaction with the initiating device, but may also be triggered without the user's direct interaction with the initiating device. Attackers exploit the hybrid pattern by combining the social engineering techniques used to set context for users and tricking users into providing them with access codes sent to their phones. These attacks are very similar to phishing attacks, except that the attacker also has the ability to trigger the authorization request to be sent to the user directly by the Authorization server. </del> <ins> In cross-device flows that follow the user-transferred authorization data pattern, the client on the Initiating Device initiates the authorization request, but the user still has to transfer the authorization code to the Initiating Device.  The authorization request may happen as a result of user interaction with the Initiating Device, but may also be triggered without the user's direct interaction with the Initiating Device. Attackers exploit the user-transferred authorization data pattern by combining the social engineering techniques used to set context for users and tricking users into providing them with access codes sent to their phones.  These attacks are very similar to phishing attacks, except that the attacker also has the ability to trigger the authorization request to be sent to the user directly by the Authorization Server. </ins> The unauthenticated channel may also be exploited in variations of <del> the above scenario where the user initiates the flow and is then tricked into sending the QR code or user code to the attacker.  In these flows, the user is already authenticated and they request a QR code or user code to transfer a session or obtain some other privilege such as joining a device to a network.  The attacker then proceeds to exploit the unauthenticated channel by using social engineering techniques to trick the user into initiating a flow and send the QR code or user code to the attacker, which they can then use to obtain the privileges that would have been assigned to the user. </del> <ins> the above scenario where the user (as opposed tot he attacker) initiates the flow and is then tricked into sending the authorization data (e.g. access code) to the attacker.  In these flows, the user is already authenticated and they request authroization data to transfer a session or obtain some other privilege such as joining a device to a network.  The authorization data may be represented as a QR code o text message.  The attacker then proceeds to exploit the unauthenticated channel by using social engineering techniques to trick the user into initiating a flow and send the QR code or user code to the attacker, which the attacker use to obtain the privileges that would have been assigned to the user. </ins> 3.4.