[Lvfs-announce] New security enhancements on the LVFS

I've just deployed two security enhancements to the LVFS. It's
important to note that is is *proactive* in response to suggestions
from OEMs, and there has not been any security issue with the service.

* All passwords will be upgraded to a modern PBKDF2, in our case using
SHA256. By logging in to the LVFS your password is automatically
upgraded and no manual action is required. Any user accounts that have
not been used by this time next year will be sent an email to remind
them.

* Local users can now optionally secure their accounts using two
factor authentication, in our case using OTP. Users can opt-in to 2FA
in the usual "Profile" menu once logged in to the LVFS. In the profile
section you can test your OTP PIN before enabling it for your account.
Two factor authentication is considered a very good way of securing
your user account and it probably a very good idea for administrator,
manager and QA user access levels. Although 2FA isn't required for all
account types at the moment, in the future we might tighten the
security policy a little bit when we know it's all working for
everybody.

As a consequence of these changes, the login dialog for the LVFS now
looks a little different. All the same buttons are there (forgot
password etc) but now the login process is a 2-step process rather
than a single process. For vendors using OAuth, nothing much changes,
and if required 2FA should be enabled by your domain administrator
rather than enabled on the LVFS.

If anyone has any problems, please let me know.

Richard.