Re-assess the security of TOTP vs other mechanisms

[ioggstream]

Task

• reassess the security of TOTP vs other mechanisms like security keys

[wurstbrot]

Hi @ioggstream ! Currently, the following is listed for 2FA: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/smartcard - $ref: src/assets/YAML/default/implementations.yaml#/implementations/yubikey - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sms - $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp

What else would you add, FIDO2?

[ioggstream]

@wurstbrot My2¢

• remove SMS since it's insecure.
• TOTP is subject to fishing since it relies on user input

Google recently gifted python package maintainers of ~4000 couples of secure keys for the above reasons.

FIDO2

current devices, including yubikey support multiple protocols, e.g. U2F, FIDO2 so not sure whether we need to add more (e.g. you'll check yubikey if you have another one)

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. :calendar: It will be closed automatically in one week if no further activity occurs.

[github-actions[bot]]

This issue was closed because it has been stalled for 7 days with no activity.