Re: [Tiki-devel] Tiki 2FA option to have authentification code pin sent by email

Same mechanism but a little bit different here as I want to use a PIN code and not a link.

Bernard


> On 31 Oct 2024, at 6:50, Gary Cunningham-Lee <[email protected]> wrote:
> 
> Ah, ok. This seems to be called a "magic link" - https://www.keepersecurity.com/blog/2024/03/07/magic-links-what-they-are-and-how-they-work/#:~:text=A%20magic%20link%20is%20a%20type%20of%20passwordless,their%20account%20without%20having%20to%20enter%20a%20password.
> 
> -- Gary
> 
> On 10/30/2024 5:32 PM, Bernard Sfez via TikiWiki-devel wrote:
>> Hello Gary,
>> 
>> Thank you for your question!
>> 
>> This feature isn’t related to passkeys.
>> 
>> This new functionality will be optional and will complement the existing login methods. Once implemented, users can continue logging in as usual or choose this option: after entering their username (or email, as a clever admin might set it up 😉) and optionally their password, they’ll receive a temporary code by email to complete the login.
>> 
>> I'm considering offering two options for a more secure 2FA login experience:
>> 
>> Option 1: Username + Password + PIN code (received by email)
>> Option 2: Username + PIN code only (bypassing the password step)
>> 
>> Hope this clarifies things!
>> Bernard
>> 
>> 
>>> On 30 Oct 2024, at 7:34, Gary Cunningham-Lee <[email protected]> wrote:
>>> 
>>> Hi,
>>> 
>>> Is this related to passkeys? Seems like most of the discussion I see about "the end of passwords" talks about passkeys as the replacement.
>>> 
>>> -- Gary
>>> 
>>> 
>>> On 10/29/2024 5:53 PM, Bernard Sfez via TikiWiki-devel wrote:
>>>> Hello,
>>>> 
>>>> I’m evaluate adding a 2FA option Tiki to allow email PIN code authentication.
>>>> 
>>>> When a user login, a PIN code is sent to his email address (SMS can be studied too) and he has to enter it in the Tiki interface to complete login.
>>>> 
>>>> This kind of 2FA was working in Tiki (somewhere around version 17) but it is not anymore.
>>>> I don’t remember a discussion about removing or changing but, may be it was for good reasons. (Anyone?)
>>>> 
>>>> So, as many websites today I would like to add an option to allow sending the code pin without the need of entering the “fixed” password.
>>>> 
>>>> … What people think ?
>>>> 
>>>> Cheers,
>>>> Bernard
>>>> 
>>>> _______________________________________________
>>>> TikiWiki-devel mailing list
>>>> [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>>> 
>>> 
>>> _______________________________________________
>>> TikiWiki-devel mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>> 
>> 
>> _______________________________________________
>> TikiWiki-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> 
> 
> 
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel



_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel