Implement 2FA about entropic HOT 6 OPEN

Some feature requirements:

• no sms
• generate a scannable QR code for the terminal; also display the number for manual input
• require successful input of one code before enabling it
• generate 10 one-time-use recovery codes
• using a recovery code un-sets 2fa

I am fine with showing the recovery codes again on a web site, preferably after some kind of short-term privilege escalation action, like, say, entering a valid OTP.

from entropic.

What I'd like to gain from Entropic-supported 2FA is the ability to prompt users for a second factor when taking sensitive actions, like publishing a package, inviting/removing folks from namespaces, or inviting/removing maintainers from packages. GitHub 2FA protects the initial sign-up process (& subsequent website sign-ins to generate tokens) but not app-specific actions.

from entropic.

I guess FIDO2 would only make sense for a web-registry login scenario https://fidoalliance.org/fido2/

from entropic.

Counter point: Github supports 2FA already. Is there a way we could check whether or not a GitHub user uses 2FA so that we can utilize that, rather than potentially having 3FA?

from entropic.

I don't think there's a way to tell if a user has 2FA enabled through the API, unless they're a member or collaborator on your org :\

from entropic.

OTP and SSS (Shamirs Secret Sharing) are also great solutions, especially to prevent the storage of full tokens.

from entropic.