2fa: add two factor authentication helper API

[aeneasr]

We could introduce a simple TOTP API endpoint for creating and validating TOTPs.

package twofa

import (
    "github.com/go-errors/errors"
    "github.com/pquerna/otp/totp"
)

type Manager interface {
    Generate(subject string) error
    Validate(subject string) error
}

type TOTP struct {
    Issuer string
    Period uint
}

func (m *TOTP) Generate(subject string) error {
    _, err := totp.Generate(totp.GenerateOpts{
        // Name of the issuing Organization/Company.
        Issuer: m.Issuer,
        // Name of the User's Account (eg, email address)
        AccountName: subject,
        // Number of seconds a TOTP hash is valid for. Defaults to 30 seconds.
        Period: m.Period,
    })
    if err != nil {
        return errors.New(err)
    }

    return nil
}

[waynerobinson]

For time-based OTP, isn't this really a responsibility of the challenge app?

Or are you planning on storing a number of per-subject keys/secrets in the DB these can be generated against because you want to be the source-of-truth for all things secure (apart from the subject's password)?

[aeneasr]

Yes, it's definitely the challenge app's responsibility. But I think that Hydra can take a supportive role in that regard and offer simple APIs to solve these sort of issues.

Am 12.09.2016 um 07:37 schrieb Wayne Robinson notifications@github.com:

For time-based OTP, isn't this really a responsibility of the challenge app?

Or are you planning on storing a number of per-subject keys/secrets in the DB these can be generated against because you want to be the source-of-truth for all things secure (apart from the subject's password)?

—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub #69 (comment), or mute the thread https://github.com/notifications/unsubscribe-auth/ADN1ellmtVu4oCCxhyyIKNT1ZhQ7utUiks5qpOUAgaJpZM4IWUYM.

[aeneasr]

Moved to unplanned because not a priority and questionable benefit.

[aeneasr]

I don't think this makes a lot of sense. 2FA is usually well supported in all major languages and it's much easier to use language-level api than network level-api.