Page MenuHomePhorge

Update TOTP suggestions to open-source applications
Closed, ResolvedPublic

Description

This task is to update the suggested 2FA/TOTP applications that are presented to users on Phorge. As of now the named suggestions are the closed-source Google Authenticator and Authy. I'd suggest that the named suggestions be open-source applications only so that members of Phorge communities are prompted to use open-source in as many places as possible. The code for these suggestions can be found in src/applications/auth/factor/PhabricatorTOTPAuthFactor.php, with the functions controlling the texts being:

public function getFactorDescription() {
  return pht(
    'Attach a mobile authenticator application (like Authy '.
    'or Google Authenticator) to your account. When you need to '. 
    'authenticate, you will enter a code shown on your phone.');
}

public function getEnrollDescription(
  PhabricatorAuthFactorProvider $provider,
  PhabricatorUser $user) {

  return pht(
    'To add a TOTP factor to your account, you will first need to install '.
    'a mobile authenticator application on your phone. Two applications '.
    'which work well are **Google Authenticator** and **Authy**, but any '.
    'other TOTP application should also work.'.
    "\n\n".
    'If you haven\'t already, download and install a TOTP application on '.
    'your phone now. Once you\'ve launched the application and are ready '.
    'to add a new TOTP code, continue to the next step.');
}

I recently updated meta.wikimedia.org/wiki/Help:Two-factor_authentication to highlight open-source 2FA/TOTP options a bit more, with the current suggestions that provide mobile apps now being:

Maybe those above or a subset of them could be the new suggestions to users when they're setting up 2FA/TOTP?

Happy to discuss the above!

Event Timeline

Cigaryno added projects: Auth, User-Cigaryno.

I will submit a patch shortly.

I'd personally not remove common proprietary software options (as it makes life of users potentially harder if they already have such an app installed) but list FOSS options first.

I'd personally not remove common proprietary software options (as it makes life of users potentially harder if they already have such an app installed) but list FOSS options first.

Some FoSS devs may not be familiar at all with open-source TOTP apps. I personally use Google Authenticator so I agree with you and also, I have my TOTP content on WinAuth too, which is unmaintained however I am not ready to switch TOTP app on my Windows PC (my revs from now on are created from an Ubuntu VM due to the arc troubles I am having on Windows).

Thank you both for the conversation here and further thanks @Cigaryno for the patch! :)