Display of current secret about adfsmfa HOT 1 CLOSED

Hello Stephan

Yes, we will soon switch to GitHub, this will be posted on the CodePlex website when it becomes effective. The versions are up to date on both platforms, except for version 2.0 beta, which we will publish on GitHub when it will no longer be a beta version.

We have made a lot of security improvements in version 2.0 (beta) present on Codeplex, look at the documentaion (being updated)

In version 1.2.5.0 the context information (email, phone number, secret key) is encrypted by ADFS (signed and encrypted with ADFS certificates for Windows 2012 R2 and encrypted with an RSA key for Windows 2016).

However, the encryption key of our extension (1.2.5.0) which uses random number generation (RNG) only to generate a TOTP key. In version 2.0 we added RSA encryption with verification, we also added an API allowing you to use your own algorithms with an example.

In the interface of the 2.0, the key is no longer displayed in the interface, it is truncated for security reasons.

Your remark is however very interesting, and since we are still on a beta, I propose to you to implement a verification (phone or email) in the case of use of an RSA key

from adfsmfa.