Security: Implement Two Factor Authentication about open-event-next HOT 4 OPEN

I think you should provide at least two options, a phone based along with an email based verification in case users cannot access to their phone.

For the phone based method, using SMS might be less efficient than application in the Worldwide range.

I see that privacyIDEA supports TOTP protocol which is supported by very popular Google Authenticator and Microsoft Authenticator app.

Here is a TOTP implementation in Nodejs: https://github.com/speakeasyjs/speakeasy. Hope it can help!

from open-event-next.

I vote for TOTP as we are not/should not require mobile numbers. It is a hassle, SMS are not free and prone to other attacks and not that secure. Mobile numbers are rotated a lot, and thus pose another security threat.
TOTP is easy to implement, free and safe

Server is in python so we need a python solution https://github.com/pyauth/pyotp

from open-event-next.

Hay is the backend written with nodeJS? Then I can take this issue.

from open-event-next.

@mariobehling Can I work on this issue?

from open-event-next.