search

catalyst / moodle-tool_mfa

A Multi-Factor Authentication Moodle plugin with flexible support for TOTP, Email, IP and more
https://moodle.org/plugins/tool_mfa
35 stars 38 forks source link

Storing full IP addresses within the mdl_tool_mfa database is not really necessary #402

Closed abias closed 2 months ago

abias commented 1 year ago

I would like to raise the question if it is really necessary to log the full IP address of the computer which registered a factor like a WebAuthn device and show it in the user's MFA settings for an unlimited time. Moreover, as we have seen that the IP address remains stored in mdl_tool_mfa even if an WebAuthn authenticator device is revoked by the user, I would like to raise the fact if there needs to be a better cleanup of revoked factors.

Storing full IP addresses is discouraged in Europe and needs a clear purpose as IP addresses have been considered as personal information by several courts. Additionally, an IP address does not have a high and long-term significance as most end user devices do not have static IP addresses.

Could the factor management be changed in a way that a) the IP address is at least stored in an abbreviated form, omiting the last digits? b) the IP address is not stored at all, instead the browser and operating system (like "Firefox on Mac OS 13" which has a much better significance for end users) is stored? c) the IP address and all other unnecessary information is cleared from the database as soon as a factor is revoked?

abias commented 2 months ago

As tool_mfa is part of Moodle core now, I transferred this improvement proposal to https://tracker.moodle.org/browse/MDL-83054.