search

hivewallet / hive-js

Hive digital currency wallet
http://www.hivewallet.com
GNU General Public License v2.0
81 stars 57 forks source link

Two-factor authentication #167

Closed weilu closed 9 years ago

ghost commented 10 years ago

How should we provide the second factor?

ghost commented 10 years ago

@w-hive Here is how I would see it.

A person enables 2fa in the settings menu. It generates a QR code, and they scan it and verify it. Then after some time the user logs out. Once they type in their pin (and successfully login), another page opens with a textbox. This is where they type in the code and submit. There should also be an option to remember this computer for 14 days since 2fa gets annoying sometimes. After they type in their 2fa successfully, they can access hive!

Im not sure about the method of creating the codes, but according to google authenticator, there are two methods: One-time Password (HOTP) (https://tools.ietf.org/html/rfc4226) Time-based One-time Password (TOTP) (https://tools.ietf.org/html/rfc6238)

I know for a fact that the authy app also supports both methods above, so any user should be able to use Google Authenticator and Authy assuming they scan the QR code that was generated.

ghost commented 9 years ago

Closing for this version. Possible Hive 2.0 feature. @mattatgit