2FA support #209

Closed
opened 2018-06-08 22:34:16 +00:00 by bandali · 11 comments
Member

Would be cool to have two factor authentication (2fa) supported in pleroma.

Would be cool to have two factor authentication (2fa) supported in pleroma.
Member

TOTP and U2F would be nice.

TOTP and U2F would be nice.
Member

So where would be a good starting point for implementing this?

Here are some points that should be implemented:

  • TOTP as a second factor
  • fallback recovery codes
  • admins should be able to remove the protection to unlock users who lost their token generator
  • U2F as a second factor
So where would be a good starting point for implementing this? Here are some points that should be implemented: * [ ] TOTP as a second factor * [ ] fallback recovery codes * [ ] admins should be able to remove the protection to unlock users who lost their token generator * [ ] U2F as a second factor
Owner

Fallback recovery codes must be done before TOTP/U2F.
I believe token unlock by admin could be added in Admin API.

Also this one is just for myself but I think TOTP is preferred as there is larger support for it and is probably easier to test as it doesn’t need extra hardware for testing (I don’t have a U2F token with my smartcard).

Fallback recovery codes *must* be done before TOTP/U2F. I believe token unlock by admin could be added in Admin API. Also this one is just for myself but I think TOTP is preferred as there is larger support for it and is probably easier to test as it doesn’t need extra hardware for testing (I don’t have a U2F token with my smartcard).
Member

Absolutely agree with you. TOTP should be done first. If the whole thing works and has been tested in the real world, U2F can be added at some later point.

Absolutely agree with you. TOTP should be done first. If the whole thing works and has been tested in the real world, U2F can be added at some later point.
Member

For the record: Preferably it should not be possible to enable U2F until TOTP has been set up by the user, so that they can still log into their account, without wasting fallback codes, when they don't have their U2F device(s) near them.

For the record: Preferably it should not be possible to enable U2F until TOTP has been set up by the user, so that they can still log into their account, without wasting fallback codes, when they don't have their U2F device(s) near them.
Owner

I don’t think fallback codes are that expensive and requiring TOTP feels more like a misstep than anything.

TOTP requires special software, the current documentation trend seems to be with the phone (hnng plz stop), and you should pretty much keep your U2F token with you all the time otherwise it quite looses it’s purpose.

I don’t think fallback codes are that expensive and requiring TOTP feels more like a misstep than anything. TOTP requires special software, the current documentation trend seems to be with the phone (hnng plz stop), and you should pretty much keep your U2F token with you all the time otherwise it quite looses it’s purpose.
Owner

Let's not have too much scope creep here. Start with TOTP, make a generic 2FA framework, and we can add U2F, Yubikey, etc later once we have the infrastructure to support it.

Let's not have too much scope creep here. Start with TOTP, make a generic 2FA framework, and we can add U2F, Yubikey, etc later once we have the infrastructure to support it.
Member

If and when U2F is supported, please make it possible to associate more than one U2F token. This is useful for backup purposes. Google allows it for example.

If and when U2F is supported, please make it possible to associate more than one U2F token. This is useful for backup purposes. Google allows it for example.
Member

When the TOTP with fallback codes part is ready and tested, U2F support with multiple devices is definitely on the todo list.

I really hope, that I’m finding the time to code that feature soon.

When the TOTP with fallback codes part is ready and tested, U2F support with multiple devices is definitely on the todo list. I really hope, that I’m finding the time to code that feature soon.

Would love to see U2F/WebAuthN

Would love to see U2F/WebAuthN
Member

Is there anything new about FIDO2/WebAuthN yet?

Is there anything new about FIDO2/WebAuthN yet?
Sign in to join this conversation.
No milestone
No project
No assignees
8 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma#209
No description provided.