Send a user notification when new MFA device enrolled

[yaleman]

When new MFA devices are enrolled, it's probably worth notifying users, in case their account has been compromised via another method.

Email's the most likely transport for this - obviously this only works if the user's got one listed - but it's better than nothing and likely to be there either way for other reasons.

[MinhPhan8803]

Could this be performed by the totp functions inside this file?

[Firstyear]

@MinhPhan8803 Not really. This is more likely to be about hooking the commit to submit an audit event that can then be stored or processed in different ways. I think it's a bigger feature than just being on the totp section, and would need a conversation and a design doc.

[MinhPhan8803]

I think I will just pass on this for now.

[Firstyear]

Yeah, this would be a pretty big block of work :)

[cmueller-tp]

I'm also interested in notifications - also for logins on new devices would be good.
In general I'd like to send chat messages in Matrix, others may want to send emails, so I think the option to call a web hook or external script would be nice for admins to configure it the way they want.

[Firstyear]

I actually think that this is related to #22 as this is just a subset of that.

Re "new device" we don't do any device fingerprinting rn so we don't have an easy/obvious way to do that.

[yaleman]

Another thread to note is #1455

[cmueller-tp]

Yep, right.
Regarding the device: you can store a signed token in the browsers local storage to "remember" the device/that a specific user logged in on that device before and wanted to remember the device. That way the user stays in control of what happens but can still be notified if there is a login from an unknown or untrusted device and the data stored is very limited.

[yaleman]

The issue is really doing the fingerprinting and identification on the server side, more than the storage requirements or enabling users to manipulate a security feature

[Firstyear]

The issue is really doing the fingerprinting and identification on the server side, more than the storage requirements or enabling users to manipulate a security feature

Yeah this. But also if a cookie/token is stolen then they can just steal the device id token too and bypass the notification. So we have to probably not use a device token/cookie to id devices here.