search

WordPress / two-factor

Two-Factor Authentication for WordPress.
https://wordpress.org/plugins/two-factor/
GNU General Public License v2.0
724 stars 151 forks source link

Timestamp for QR and Backup Code keygen #593

Closed richardkentgates closed 5 months ago

richardkentgates commented 8 months ago

Is your enhancement related to a problem? Please describe.

I know phishing is not a bug, but email is an option, and it is a popular option. I just recently dealt with a phishing attack where email was set up and I had no way to know if the attacker reset the backup codes, giving them secondary access. I imagine it would also be possible to setup the time based token and as long as it isn't set to primary, the behavior would not seem unusual and may be missed.

Proposed Solution

Rather than being combative with users over the policy, which is why I assume the email option is available, maybe we could get a time and date that can be matched with the backup code metadata time and date where it is stored, allowing users to cross-reference the file time date with the time date in their user profile. A time and date to reference would give us something to at least compare.

Another suggestion would be an email notification when any two-factor settings are changed for that user. Both of these being implemented would be helpful for admins and users.

Thank you all for your hard work on this plugin.

Designs

N/A

Describe alternatives you've considered

We currently advise clients of the risk of using the email option in the plugin

Please confirm that you have searched existing issues in this repository.

Yes

iandunn commented 8 months ago

Related #476 #526 #459 #462

kasparsd commented 5 months ago

Version 0.9.0 of the plugin now requires two-factor authentication for changing any of the two factor settings which was introduced in #529.

@richardkentgates I believe that should also solve your use-case where anyone with access to an active user session is unable to regenerate the recovery codes. Can you please verify that functionality?

kasparsd commented 5 months ago

I was able to verify that recovery codes can't be re-generated without re-authenticating with the second factor:

disabled

This appears to solve all types of account takeover through session re-use. Please let me know if you feel this doesn't address the issue you describe.