TOTP support (Google Authenticator, Aegis, …) together with WebAuthn for two-factor authentication (2FA)

[rugk]

It would be great if you could also support TOTP in addition to U2F/WebAuthn (i.e. hardware keys) + backup tokens, you currently already have.

This would allow a better backup strategy/multiple options to use, especially if one does not have a hardware key (although that would likely be better).

App support

Many apps are there which you can use to scan the QR code you get:
https://search.f-droid.org/?q=totp

Most famously Google Authenticator and Microsoft Authenticator, though both not the best ones, possibly.
Aegis is e.g. a very good one.

[willbrowningme]

TOTP is already supported, however you can currently only have either TOTP or WebAuthn two factor enabled at any one time.

If you can't see TOTP you need to disable WebAuthn then you will be able to see it.

[rugk]

Well... there is no reason to implement it like this, i.e. so I assume this is a missing feature. As I said, TOTP is a better fallback to WebAuthn than these static backup codes, so well...

[willbrowningme]

I agree it would be nice to have both enabled at the same time and to be choose which to use, I'll see if I can add this in the near future.

[ghost]

hi,
is there any update about this ? it will be a really good security feature if you add hardware keys as a 2fa method along side totp and we chose what to use everytime we try to login.

[willbrowningme]

No update at the moment I'm afraid, it would be good to see some code of someone who has already implemented this with Laravel so I can see how they achieved it.

[rugk]

I am not sure if this is Lavarel, but that is python is not it? Here you can see how the German community site FragDenStaat implemented it: okfde/froide#480

The framework used is also linked there.

[uhlhosting]

@willbrowningme hi, is there a way to disable manually from cli the 2fa for a given user? It seems i got myself locked.

[willbrowningme]

You can run:

php artisan tinker from the web app directory.

Then find your user:

$user = Username::firstWhere('username', 'johndoe')?->user;

Then if you have TOTP 2FA run:

$user->two_factor_enabled = false;
$user->save();

If you use webAuthn run:

$user->webauthnKeys()->delete();