Display Input When Entering 2FA Code about security-package HOT 6 CLOSED

@phoenix128 TIL the term "shoulder surfing". That being said I don't really agree with this. Even if you obscure the input in Magento it will be shown in plain text to the user on their 2FA device that they pull it from. Someone could also watch their key stroked on the keyboard. I use 2FA from many big providers like Google / GitHub and have never seen the 2FA input field obscured.

from security-package.

@phoenix128 Any updates on this? Magento's implementation runs counter to every single other instance of 2FA that I've seen.

from security-package.

Hello @mpchadwick ,
this is the expected behaviour. I understand your point, but I consider an obscured field slightly more secure than a clear field, even if we are dealing with a 2FA code.
I would like to avoid a shoulder surfing issue allowing the usage of the same code twice in the same time interval.
Does it make sense for you?

from security-package.

I will discuss this internally.

from security-package.

+1 for showing 2FA code while you're typing it. People just doing mistakes, probably because of it all big companies not hiding it

from security-package.

Feature already added to new release.

from security-package.