MFA and passkeys

[ap0int3d]

Hi,
I would like to talk about several subjects tied to MFA and passkeys. I'll offer several scenarios to help understand my thoughts.

Scenario 1:
In the current build (PR #147), when user have both a passkey and a TOTP app configured on their account, the login process can follow 2 paths:

1. User inputs their credentials (username and password) as a first authentication factor. Then they are asked to choose a second factor between their TOTP app or their passkey (I voluntarily leave recovery codes on the side here). Once successful, they get access to WebSSH.
2. User choose their passkey and if successful, they get access to WebSSH.

The second path looks faster and easier. It might not be as simple as it looks based on how the passkey can be accessed but the complexity would still be higher in path 1 with MFA using the passkey than in path 2. In both cases, you would need to unlock access to the passkey but in path 1 you would also need to input your credentials. So if users decided to create a passkey, they would very likely always follow path 2.

Based on that premise, the question that came to mind is : in which situations would the user take the first path ?
I may be too narrow-minded but the only answer I found is the following: if their passkey is unavailable.
In that case, the only way to access WebSSH is to use their credentials and their TOTP app as the second factor.

This leads me to think that the passkey will probably never be used as a second factor in the first path and could as well be removed.
Happy to be contradicted on this topic.

Scenario 2:
Let's explore the case of a user who has a passkey but no TOTP app. This means that the user has both a strong way to connect (their passkey) and a weak way to connect (their credentials) and both are usable at any time. For an attacker, there is a clear easier way to gain access.
Maybe it would be interesting to make TOTP mandatory when configuring a passkey to enhance the overall account security.
This is especially important in my mind in a "production" deployment where WebSSH is publicly accessible.

Not-really scenario 3:
Passkeys and MFA are currently left to user choice. The admin has no way to make one or the other or both mandatory for all or a subset of users. Not sure if allowing to manage on a subset of users is really useful but at least it would be for all users in my opinion.

Looking forward to read feedbacks on these topics.

[bifrost0x]

Proposed in PR #151. The modes are now explicit: Sign in with Passkey remains a direct passwordless, phishing-resistant login; enrolling a Passkey alone does not silently change the password path. After enrolling and testing a Passkey, Security now offers Require Passkey MFA for password sign-in. That action requires recent Step-up, enables account MFA atomically, and issues a one-time Recovery Code set, so password or directory login can no longer remain a single-factor fallback. An administrator-wide mandatory-MFA policy is intentionally not included yet: it needs enrollment grace periods, recovery/break-glass rules, and defined handling for service and directory-managed accounts to avoid mass lockout. Those boundaries are documented in the same PR.

[ap0int3d]

Hi @bifrost0x ,
After testing the changes #151 brought, here is my feedback:
When removing all TOTP app, it also disable MFA even if passkeys were configured to act as MFA. It is not the case the other way around.
In my opinion, as long as you have one remaining MFA method enabled, MFA should not be disabled.

I also think the UI needs a bit of refining to make things easier for the user. Here is my take on the design:

This only shows the dedicated "Passkeys and MFA" section of the Security menu. The other sections are not shown here.
You can see a checkbox under the passkey list to enable the MFA role on all passkeys. If there are no passkey configured, the checkbox should remain greyed out or hidden.
Another design could make this role specific to a subset of passkeys in the list.
This design allows to delete TOTP apps one by one. When deleting the last TOTP app, WebSSH should check if passkeys are enabled to be used as MFA. If yes, MFA stays enabled. If not, MFA is disabled.
The same behavior should be observed when deleting passkeys. When deleting the last MFA-enabled passkey, WebSSH should check if a TOTP app exist. If yes MFA stays enabled. If no, MFA gets disabled.
The MFA status at the top of the section, should be updated dynamically after every change.

What do you think ?

[bifrost0x]

Implemented and merged in PR #155. It:

• keeps MFA enabled while another durable factor (Passkey or TOTP) remains;
• prevents deletion of the final MFA factor;
• supports deleting individual TOTP authenticators;
• centralizes and dynamically refreshes the account-wide MFA status and factor lists;
• improves the Security page grouping and accessibility.

Thanks for the detailed feedback and design proposal.

[ap0int3d]

Works nicely. Well done !