Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement Account Recovery #37

Closed
5 tasks
aeneasr opened this issue Jul 22, 2019 · 0 comments
Closed
5 tasks

Implement Account Recovery #37

aeneasr opened this issue Jul 22, 2019 · 0 comments
Assignees
@aeneasr
Labels
package/selfservice Affects selfservice components
Milestone
v0.4.0-alpha.1

Comments

@aeneasr
Copy link
Member

aeneasr commented Jul 22, 2019 •
edited
Loading

Included

Excluded

  • I want to set up one or more security questions for account recovery: Security questions have often been abused in social engineering attacks (e.g. Celebrity Leaks) because their answers ("What's your mother's maiden name?") are often easy to discover using OSINT attacks. Needs docs.
  • I want to recover my account using SMS or phone calls: SMS for credential exchange isn't particularly secure (source, source). The problem with account recovery is that a single TOTP can switch ownership of an entire account. While with 2FA, both credentials (password) and TOTP are required, account recovery really has only one credential which can be eavesdropped using sim swapping and similar. Maybe something like IMSI can help though but that needs further investigation. Needs docs.
@aeneasr aeneasr added the package/selfservice Affects selfservice components label Jul 22, 2019
@aeneasr aeneasr added this to the v0.0.1 milestone Jul 22, 2019
@aeneasr aeneasr self-assigned this Jul 22, 2019
@stale stale bot added the stale label Jul 23, 2019
@ory ory deleted a comment from stale bot Jul 23, 2019
@aeneasr aeneasr removed the stale label Jul 23, 2019
@aeneasr aeneasr modified the milestones: v0.0.1, v0.0.2 Aug 8, 2019
@aeneasr aeneasr modified the milestones: v0.2.0-alpha.1, v0.1.1-alpha.1 Feb 1, 2020
aeneasr added a commit that referenced this issue May 19, 2020
@aeneasr
feat: implement account recovery skeleton (#294)
701734d 
This patch implements the account recovery request skeleton with endpoints such as "Init Account Recovery", a new config value `urls�.recovery_ui` and so on.

Additionally, some refactoring was made to DRY code and make naming consistent.

See #37

BREAKING CHANGEs: The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with  `selfservice.verification.request_lifespan`.
@aeneasr aeneasr mentioned this issue May 19, 2020
Closed
aeneasr added a commit that referenced this issue May 19, 2020
@aeneasr
feat: implement account recovery skeleton
25de3fe 
This patch implements the account recovery request skeleton with endpoints such as "Init Account Recovery", a new config value `urls�.recovery_ui` and so on.

Additionally, some refactoring was made to DRY code and make naming consistent.

See #37

BREAKING CHANGEs: The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with  `selfservice.verification.request_lifespan`.
@aeneasr aeneasr mentioned this issue May 19, 2020
Merged
2 tasks
aeneasr added a commit that referenced this issue Jun 3, 2020
@aeneasr
feat: implement account recovery skeleton
72b5d19 
This patch implements the account recovery request skeleton with endpoints such as "Init Account Recovery", a new config value `urls�.recovery_ui` and so on.

Additionally, some refactoring was made to DRY code and make naming consistent.

See #37

BREAKING CHANGEs: The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with  `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 3, 2020
@aeneasr
feat: implement acocunt recovery
e3d6eb6 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 3, 2020
@aeneasr
feat: implement acocunt recovery
fac048e 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 3, 2020
@aeneasr
feat: implement acocunt recovery
e204a7b 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 3, 2020
@aeneasr
feat: implement acocunt recovery
f494a83 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 3, 2020
@aeneasr
feat: implement account recovery skeleton
b1e9183 
This patch implements the account recovery request skeleton with endpoints such as "Init Account Recovery", a new config value `urls�.recovery_ui` and so on.

Additionally, some refactoring was made to DRY code and make naming consistent.

See #37

BREAKING CHANGEs: The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with  `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 3, 2020
@aeneasr
feat: implement acocunt recovery
832815e 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 5, 2020
@aeneasr
feat: implement acocunt recovery
f8462b9 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 5, 2020
@aeneasr
feat: implement acocunt recovery
cea5715 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 5, 2020
@aeneasr
feat: implement acocunt recovery
fab48c9 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
aeneasr added a commit that referenced this issue Jun 5, 2020
@aeneasr
feat: implement acocunt recovery
63e404d 
This patch implements the account recovery with endpoints such as "Init Account Recovery", a new config value `urls.recovery_ui` and so on. Additionally, some refactoring was made to DRY code and make naming consistent. As part of dependency upgrades, structured logging has also improved and an audit trail prototype has been added (currently streams to stderr only).

Closes #37

BREAKING CHANGES:

* Applying this patch requires running SQL Migrations.
* The field `identity.addresses` has moved to `identity.verifiable_addresses`. A new field has been added
`identity.recovery_addresses`. Configuration key `selfservice.verify` was renamed to `selfservice.verification`. Configuration key `selfservice.verification.link_lifespan`
has been merged with `selfservice.verification.request_lifespan`.
@aeneasr aeneasr closed this as completed in e169a3e Jun 5, 2020
aeneasr added a commit to ory/kratos-selfservice-ui-node that referenced this issue Jun 6, 2020
@aeneasr
refactor: use messages instead of errors
aca63a8 
See ory/kratos#476
See ory/kratos#428
See ory/kratos#37
@aeneasr aeneasr mentioned this issue Jun 6, 2020
Merged
5 tasks
aeneasr added a commit to ory/kratos-selfservice-ui-node that referenced this issue Jun 6, 2020
@aeneasr
refactor: use messages instead of errors (#48)
e9f96aa 
See ory/kratos#476
See ory/kratos#428
See ory/kratos#37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@aeneasr aeneasr

Labels
package/selfservice Affects selfservice components
Projects
None yet
Milestone
v0.4.0-alpha.1
Development

No branches or pull requests
1 participant
@aeneasr