Cornelius Kölbel

We need to add tests that write data in timezoneA and read data i timezoneB. => Check how timezones can be set in tests.

In 3.4 we will save challenges in UTC. So we are on the safe side, if a database should not support timezone aware fields. This issue will only handle challenges.

A Todo List can be part of an internal inbox-system or notification-system. The Init Wizard in #716 can be an initial message in the administrators inbox. This Todo List can...

We could also add triggers, if one todo item was marked as done. We would need an API to modify the todo item. This API would be used to trigger...

@cparkins To me this sounds as if this is only about login to the selfservice portal. How would authentication look like? You need to assign 2nd factors/token to user objects,...

Hm, I do not understand "Input can be either the password/pin or that+OTP." In my understanding there is only one login, that leads to success. Or is this a client,...

Well, at least this is a very generic issue. I think all this makes its own sense with its own functionality. There is a perfect reason, why some tokens are...

I think this is because the result of the API call is written to the audit log. Probably easy to fix by using a ``bool()``. ~~~~python g.audit_object.log({'success': bool(ret), 'info': name})...

I am not sure about this. Can you check? So we could be able to always return True, otherwise an exception might have been raised.

I am not sure, if we should/can remove this completely. There might be other situations (like SSH login), that might still use U2F. I would suggest removing the visibility of...