Add possibility to add multiple TOTP devices

[MariusBluem]

Something like nextcloud/twofactor_u2f#40 just for TOTP 😜

What do you think? @ChristophWurst

[ChristophWurst]

Already supported, just scan the QR code with all your apps/devices, just like on GitHub. Ref https://help.github.com/articles/configuring-two-factor-authentication-via-a-totp-mobile-app/

[MariusBluem]

Well ... yes :D But this does not give you the option to revoke a single device if lost... and the QR code does only appear once, and it would require you to save the QR code - or to reconfigure every device if you want to add one 😅

[ChristophWurst]

Sure, but it's not possible security-wise. We'd have to check x OTP secrets on login, because we don't know which of your x devices is used. This trial and error method would break the necessary effort to guess the TOTP key by x. I doubt this is what we want :-)

cc @LukasReschke because I'm not 100% sure if the above is true, it's just my assumption of how this would work.

[MariusBluem]

sounds logical. And an option to show the QR-code again? 😁

[ChristophWurst]

Dunno if that's a good idea …

[astriffe]

... sorry for hijacking, but: What can I do if I got a new phone in order to register it? There's no QR code displayed and I'd really like not to loose all app-passwords. Can I transfer the TOTP information from my old phone to the new one?

[MariusBluem]

Depends on whether your TOTP client supports that natively. You may also want to save your QR-code (or the text-based code) before the codes are hidden - then you could register every device you want - everytime 💪 @astriffe

[astriffe]

Thanks a lot for your swift response @MariusBluem. To save the QR code when scanning would probably deserve a prominent place in the docs ;) I'm using https://github.com/0xbb/otp-authenticator as a second factor. Do you know whether the code is stored in clear text on my server? Or is there no way around re-initializing everything?
Just deactivated 2FA and reactivated it again to get the new code. App-passwords still seem to work :)

Cheers

[Gijom]

Just my two cents: saving the QR code somewhere unsafe is not secured: enybody who has access to it would be able to enter the 2nd auth code (but still need your password before that).
You would need to save the QR code in a safe place.

I recommend pass and pass-otp for that. Pass-otp can regenerate the QR code from the URI if needed. To get the URI from the QR code you can use zbar.

[emilioalaca]

I use 2FA for other institutions and they naturally allow multiple devices. This thread makes me think that they are not really secure. As a method, I usually doubt what I think, but in this case I am having great difficulty believing myself ;-). Help?

[nhed]

heroku allows multiple devices with unique qr codes for each.

[davidbonnet]

Note that AWS also allows for multiple devices to be registered.