globaleaks / whistleblowing-software

GlobaLeaks is free, open-source whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform.
https://www.globaleaks.org
Other
1.23k stars 269 forks source link

MFA QR-code all identifies as GlobaLeaks #3021

Closed schris-dk closed 3 years ago

schris-dk commented 3 years ago

Hi!

As an administrator of a large number of sites, we are now starting to enforce MFA for our Recipients - but this is creating an irritating issue for those (both recipients and administrators) that have multiple accounts to log into.

The QR-code delivered for connection between the account and the authenticator app is leveraging the same account/site name - "GlobaLeaks". This means, when you add a new account, the old one gets overwritten.

In the app it is possible to manually rename the account, but this will require a lot of explaining to all the "multi recipients" - ad potentially end in data loss.

Would it be possible to add the Site name to the QR-code, making the account name look like "GlobaLeaks - [site name]"?

evilaliv3 commented 3 years ago

Thank you for the feedback @schris-dk.

After thinking a little bit about your suggestion we consider that to raise usability we could accept to not include the brand name (Globaleaks) within the name of the acconunt but to that would be actually important to prioritize to show the following informations: 1) the hostname 2) the username

I'm now going to issue a patch in order to create an account name as: $hostname ($username)

Example: whistleblowing.nsa.gov (name.surname)

schris-dk commented 3 years ago

Hi Giovanni!

This sounds great !!

Thnx

Soren

Søren Christensen Senior manager BDO Risk Assurance - Forensic Services @.*** +45 30 93 49 33


Fra: Giovanni Pellerano @.> Sendt: Sunday, September 12, 2021 9:26:58 AM Til: globaleaks/GlobaLeaks @.> Cc: Søren Christensen @.>; Mention @.> Emne: Re: [globaleaks/GlobaLeaks] MFA QR-code all identifies as GlobaLeaks (#3021)

Thank you for the feedback @schris-dkhttps://github.com/schris-dk.

After thinking a little bit about your suggestion we consider that to raise usability we could accept to not include the brand name (Globaleaks) within the name of the acconunt but to that would be actually important to prioritize to show the following informations: 1) the hostname 2) the username

I'm now going to issue a patch in order to create an account name as: $host ($username)

Example: whistleblowing.nsa.gov (name.surname)

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/globaleaks/GlobaLeaks/issues/3021#issuecomment-917575253, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AQ5NSMXD766HYUDQHUJUPILUBRI4FANCNFSM47WHIUMQ. Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.