search

loki36 / user-otp

OTP Backend for owncloud
34 stars 21 forks source link

Allow separate password when accessing via remote.php #88

Closed sorenweber closed 9 years ago

sorenweber commented 9 years ago

I would like to use two-factor authentication, and at the same time "Disable OTP with remote.php (webdav and sync)". However, this means the security is reduced since an attack will then target remote.php.

To improve the security in that case I would like to set a really, really long and complex password that would be used only when accessing via remote.php (since it would be too hard to remember).

Can this be done?

loki36 commented 9 years ago

Hi,

this need to modify OTP class. But there is someone who rewrite this app in order to use prelogin hook and it will not be possible to do that if i merge this rewrite. And this rewrite of code should solved lot of issue with other backend.

if you know php and want try by yourself, you should try on line 244 from file user_otp/lib/otp.php

sorenweber commented 9 years ago

Alright, I'll look forward to the rewrite. Thanks!