Have a 'trust this device' option on auth page about moodle-tool_mfa HOT 3 CLOSED

There is a small chicken and egg problem with this one. If we configure it as an early factor, then we can trust a device without going through other factors. But if we configure it to be done last we'll never get to it. The UX in google is that this is built into the other factors as a 'Remember me on this device' when you verify them.

Perhaps the cleanest architecture is the order doesn't matter but we have a 'post_verify' method that any factor can hook into to provide a page where people can opt into this.

from moodle-tool_mfa.

Rewording this slightly to address the general 'Trust this device for x time' Feature

from moodle-tool_mfa.

Cross posting from #15 :

Proposal:

A cookie with a code stored on the client side, provided to the auth page to verify.

Requirements for cookie:

There is only one presented code.
An incorrect cookie with a current timestamp should be an instant factor lock
The IP coming in with a cookie MUST be the same as a 'lastverified' and that must have been within 24 hrs.
The cookie can only be set by an input factor, and ONLY if an input factor was used to verify
Considerations: This is a potential weakening of MFA due to device theft etc. Integrate with other factors. Factor reliance API? Might be achievable with just points

from moodle-tool_mfa.