Timestamp for QR and Backup Code keygen
richardkentgates opened this issue · 3 comments
Is your enhancement related to a problem? Please describe.
I know phishing is not a bug, but email is an option, and it is a popular option. I just recently dealt with a phishing attack where email was set up and I had no way to know if the attacker reset the backup codes, giving them secondary access. I imagine it would also be possible to setup the time based token and as long as it isn't set to primary, the behavior would not seem unusual and may be missed.
Proposed Solution
Rather than being combative with users over the policy, which is why I assume the email option is available, maybe we could get a time and date that can be matched with the backup code metadata time and date where it is stored, allowing users to cross-reference the file time date with the time date in their user profile. A time and date to reference would give us something to at least compare.
Another suggestion would be an email notification when any two-factor settings are changed for that user. Both of these being implemented would be helpful for admins and users.
Thank you all for your hard work on this plugin.
Designs
N/A
Describe alternatives you've considered
We currently advise clients of the risk of using the email option in the plugin
Please confirm that you have searched existing issues in this repository.
Yes
Version 0.9.0 of the plugin now requires two-factor authentication for changing any of the two factor settings which was introduced in #529.
@richardkentgates I believe that should also solve your use-case where anyone with access to an active user session is unable to regenerate the recovery codes. Can you please verify that functionality?
I was able to verify that recovery codes can't be re-generated without re-authenticating with the second factor:
This appears to solve all types of account takeover through session re-use. Please let me know if you feel this doesn't address the issue you describe.