Implemented Two-Factor Authentication

[digitalpoint]

Google's Authenticator app for iOS, Android and Blackberry allows you to use it to generate 2-factor authentication codes for anything that can use them (does not need to be just your Google account).

It allows you to have an account that after you enter the login/password, you are prompted for a 6-digit code that changes every minute. The app on your phone generates the code... so essentially even if someone got your login/password, they couldn't access your account unless they had physical access to your cell phone (or any iOS device for the iPhone version).

An example of how it works for your Google account:

It would be really cool if XenForo supported this security model as an option for users (or maybe even a mandatory thing for admins/mods).

Again... does not require linking your Google account to XenForo, but you can use the Google Authenticator app for any account/site.

 

[digitalpoint]

With Google Two Step authentication, once it's set up on your phone, the codes are generated there and there's no need to login to Google again.

For purposes of my addon, you never need a Google account of any sort to begin with. You don't need a Google account to use the Authenticator app.

If you want to use it to two-factor authenticate your Google account, in that case you would obviously need a Google account TO authenticate... but that's totally separate.

 

[mjda]

Yeah, I see how it works now. I asked when I could have just done it the non-lazy way. I went over and set up my 2-factor authentication at DP now.

 

[Mouth]

No point really... someone else released one in the Resource Manager I believe.

http://xenforo.com/community/resources/freddyshouse-two-factor-authentication.1663/
... been working great on my site for over 6mths now.

Would LOVE to see it as native functionality.

 

[erich37]

how would this work without utilizing "Google's Authenticator App" ?
NSA you know......

 

[agison]

+1

 

[James]

how would this work without utilizing "Google's Authenticator App" ?
NSA you know......

Use a different authenticator app. Google's authenticator app isn't the only one on the market, nor is it particularly evil.

 

[r1pe]

Native support would be awesome +1

 

[Null]

@digitalpoint, would you be interested in releasing this? Maybe for DP Premium members?

I know there are a few out there, but I don't like installing add-ons from authors I don't know/trust.

 

[TPerry]

@digitalpoint, would you be interested in releasing this? Maybe for DP Premium members?
I know there are a few out there, but I don't like installing add-ons from authors I don't know/trust.

That's your option... but I've never had any problem with this add-on by @Deebs.
If you become dependent on only one or three authors then you will be missing out on some very good add-ons.

 

[digitalpoint]

@digitalpoint, would you be interested in releasing this? Maybe for DP Premium members?

I know there are a few out there, but I don't like installing add-ons from authors I don't know/trust.

Eh... honestly just don't see it happening in the short term. A few reasons...

• It was never designed as a stand-alone thing, so it would take some work to separate out that one function from our overall security addon (and before you ask, some stuff in that addon couldn't be used by other sites).
• There is some level of protection/security by not letting others get into the code. Not that I'm really worried about it, just security related stuff that *I* use, I'm never too keen on letting people hammer on it to try to figure out ways to circumvent it (same general idea with my anti-spam stuff... if people start understanding HOW it works, it makes it less valuable).
• There's a lot of way more interesting stuff that would be a better allocation of my time to wrap up into something installable... things that *aren't* already out there by other authors.

 

[Deebs]

That's your option... but I've never had any problem with this add-on by @Deebs.
If you become dependent on only one or three authors then you will be missing out on some very good add-ons.

Thank you @Tracy Perry, I've known the guy I get to develop the FreddysHouse addons (@SheepCow) for over 10 years, I work in the IT industry and I strive for the best and I am completely anal when it comes to security (had a BCrypt password addon way before XF started using it, not sure if I released it here). The addon has no issues when it comes to two factor using Google Authenticator or Yubico keys and is easily extensible to add others.

 

[Brent W]

Would love to see this. Especially for admins. I have enabled it on pretty much every important account I own that allows me to.

 

[naia]

I would also love to see this as an Xenforo feature.

 

[Rasmus Vind]

While at it, why not add support for SQRL? I would rather use something open than be forced to have a Google account in order to get two factor authentication.

 

[digitalpoint]

You don't need a Google account.

 

[naia]

While at it, why not add support for SQRL? I would rather use something open than be forced to have a Google account in order to get two factor authentication.

this ^

 

[SamL]

I know this is an older suggestion, but I just wanted to give it a bump along with my Like.
It would be a great thing to implement in the core of an upcoming XF version, and not likely too difficult to include support several different authenticators. (Google, Authy, Yubi-Key, etc).

 

[Renegade]

So now that we have google login and google account can have two factor authentication, isn't the functionality for staff members essentially achieved? Of course there is no way to force it based on the user group yet.

 

[SamL]

So now that we have google login and google account can have two factor authentication, isn't the functionality for staff members essentially achieved? Of course there is no way to force it based on the user group yet.

No, that only means that two-factor is possible for the Google Account itself (not the forum account) and only for those people that have Google accounts.
Even the Google Authenticator Two-Factor app doesn't require using Google Account.

 

[Liam W]

I have an add on for this, native support would be nice I guess

Liam