search

magento / security-package

Magento Security Extensions
Open Software License 3.0
73 stars 69 forks source link

Authy Remember Me Option #311

Closed birdman002 closed 2 years ago

birdman002 commented 3 years ago

Description (*)

This feature request pertains to Authy. There used to be a remember me section when logging in with your Authy Two Factor Code. This behavior allowed users to stay logged in and wouldn't have to present their code every time they logged in.

Expected behavior (*)

Upon log in and uses their authy method there would be a button in the bottom that says remember me. Then when the user comes back and logs into the admin they would go to the dashboard instead of having to perform the authy log in again.

Benefits

Not only for usability the user isn't having to present their authy code each time they log in, but save cost as well. Our monthly bills are quite high with the amount of people logging into the admin and using their authy codes.

Additional information

None.

nathanjosiah commented 2 years ago

@birdman002 Thank you for this suggestion! Unfortunately this was intentionally removed in order to require a second factor of authentication for every login. If this was added back in, it essentially bypasses 2fa completely which defeats the purpose of 2fa. Looking at Authy's pricing it looks like 100+ auths per month are $0.09/each which I can see would add up quickly depending on how many users you have and what session length you have configured. You may want to investigate one of the other authentication providers such as Google which is free or u2f keys which have a one time cost.