This topic is locked

Two factor Authentication Problems

7/3/2017 1:37:46 AM
PHPRunner General questions
romaldus author

I have a running website (a membership system created using phprunner 9.7 enterprise) and i want to upgrade the project using phprunner 9.8 enterprise. Perhaps the most interesting feature comes with version 9.8 is "Two Factor Authentication (TFA)" and it's working perfectly.

However I am having trouble using TFA in current system, where more than 1000 members have been registered.

Enable "Use two-factor authentication" option on PHPRunner IDE means Forcing all 1000+ registered members to use TFA after successfully login. Problems that may occur are, there are many members who can not login because they didn't fill the phone number correctly, or have changed their the phone number, or lost their smartphone.
Some ideas to resolve this problem:

  1. There should be a field in user table ("tfa" for example) where logged in members can choose to enable or disable TFA
  2. When a registered member choose to enable TFA, there should be a process to verify his phone number.
  3. Incase a member cannot receive SMS or lost his smartphone, there should be a procedure to disable TFA from login page (something like resetting password procedure)
    I have tried to intercept the login process to enable or disable TFA based on a field value in user table ("tfa" field) but with no luck <img src='https://asprunner.com/forums/file.php?topicimage=1&fieldname=question&id=24825&image=1&table=forumtopics' class='bbc_emoticon' alt=':)' />
    I found that the only way to disable or enable TFA in generated code:
  4. Edit file classes/loginpage.php in line 43 set $this->twoFactAuth = false;
  5. Edit file include/appsettings.php in line 453 set $globalSettings["bTwoFactorAuth"] = false;
    Is there any solution for this problem?

R
Rigmantas 7/3/2017

Hi,

There is my opinion:

Will be good if in administration panel you add next possibility:
Regards

Rimantas

jadachDevClub member 7/3/2017

I don't think allowing an option to have two-factor on/off is a good idea. It kind of defeats the purpose.

I do however think there needs to be a way to reset phone number. Not sure how that would work though.

If you transition to two-factor, you should give notice to all users to update their phone numbers prior to implementing.
On my banking website there is two-factor. If I do not have access to my phone or I lost it, etc., you need to call them.

Sergey Kornilov admin 7/3/2017

We will implement this at some point. I can see this useful in some apps where security is less important. Gmail does that.