Re: [Tiki-devel] Tiki 2FA option to have authentification code pin sent by email

Hi Bernard and all

Are you sure this used to be in Tiki? I have no recollection of it, but there are still features in Tiki i don't know about... even now ;)

Sounds like a good idea, lots of people can't remember their passwords ever so a pin-per-session thing might suit in some cases, so yes please! :p

jonny



> On 31 Oct 2024, at 09:50, Bernard Sfez via TikiWiki-devel <[email protected]> wrote:
> 
> Same mechanism but a little bit different here as I want to use a PIN code and not a link.
> 
> Bernard
> 
> 
>> On 31 Oct 2024, at 6:50, Gary Cunningham-Lee <[email protected]> wrote:
>> 
>> Ah, ok. This seems to be called a "magic link" - https://www.keepersecurity.com/blog/2024/03/07/magic-links-what-they-are-and-how-they-work/#:~:text=A%20magic%20link%20is%20a%20type%20of%20passwordless,their%20account%20without%20having%20to%20enter%20a%20password.
>> 
>> -- Gary
>> 
>> On 10/30/2024 5:32 PM, Bernard Sfez via TikiWiki-devel wrote:
>>> Hello Gary,
>>> 
>>> Thank you for your question!
>>> 
>>> This feature isn’t related to passkeys.
>>> 
>>> This new functionality will be optional and will complement the existing login methods. Once implemented, users can continue logging in as usual or choose this option: after entering their username (or email, as a clever admin might set it up 😉) and optionally their password, they’ll receive a temporary code by email to complete the login.
>>> 
>>> I'm considering offering two options for a more secure 2FA login experience:
>>> 
>>> Option 1: Username + Password + PIN code (received by email)
>>> Option 2: Username + PIN code only (bypassing the password step)
>>> 
>>> Hope this clarifies things!
>>> Bernard
>>> 
>>> 
>>>> On 30 Oct 2024, at 7:34, Gary Cunningham-Lee <[email protected]> wrote:
>>>> 
>>>> Hi,
>>>> 
>>>> Is this related to passkeys? Seems like most of the discussion I see about "the end of passwords" talks about passkeys as the replacement.
>>>> 
>>>> -- Gary
>>>> 
>>>> 
>>>> On 10/29/2024 5:53 PM, Bernard Sfez via TikiWiki-devel wrote:
>>>>> Hello,
>>>>> 
>>>>> I’m evaluate adding a 2FA option Tiki to allow email PIN code authentication.
>>>>> 
>>>>> When a user login, a PIN code is sent to his email address (SMS can be studied too) and he has to enter it in the Tiki interface to complete login.
>>>>> 
>>>>> This kind of 2FA was working in Tiki (somewhere around version 17) but it is not anymore.
>>>>> I don’t remember a discussion about removing or changing but, may be it was for good reasons. (Anyone?)
>>>>> 
>>>>> So, as many websites today I would like to add an option to allow sending the code pin without the need of entering the “fixed” password.
>>>>> 
>>>>> … What people think ?
>>>>> 
>>>>> Cheers,
>>>>> Bernard
>>>>> 
>>>>> _______________________________________________
>>>>> TikiWiki-devel mailing list
>>>>> [email protected]
>>>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>>>> 
>>>> 
>>>> _______________________________________________
>>>> TikiWiki-devel mailing list
>>>> [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>>> 
>>> 
>>> _______________________________________________
>>> TikiWiki-devel mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>> 
>> 
>> 
>> _______________________________________________
>> TikiWiki-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> 
> 
> 
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel



_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel