Suggest TOTP for entries using a web service [$50]

[OLLI-S]

Summary

KeePassXC should tell if there are entries, where 2FA is available but not yet set up.

Details

In KeePassXC I have set up 2FA for some entries, but I know that 2FA is available for many more entries.
The Two Factor Auth List (https://twofactorauth.org/) offers a list of websites, where TOTP is available.
In this list the column "Software Token" indicates that an entry uses a TOTP that can be managed by KeePassXC.
In the column "Docs" there is a link to the documentation how to enable TOTP for the website.
The data of the website is also available via JSON: https://twofactorauth.org/data.json

How should this work?

1. KeePassXC should check all URLs in the database against the 2FA-list.
2. If there is a match (the URL stored in KeePassXC is found in the 2FA-list), then KeePassXC should check in the 2FA-list if the "software token" is supported by this entry.
3. If the software token is supported then KeePassXC should check if the entry in KeePassXC has the custom field "otp" (if already a TOTP is available) and if the field is filled (might be an empty field).
4. If the custom field "otp" is not existing (or has an empty value) the name of the entry (that is stored in KeePassXC) should be added to a list of services where TOTP is available but not activated.
5. After the check is completed the user gets this list shown where he can see all the entries where TOTP should be activated.
   In this list there is also a column "Documentation" where you show the URL of the documentation.
   So users just need to click the URL to open it.

As an optional feature the list may also contain entries, where TOTP is already set up in KeePassXC (these entries have a green checkmark).
The entries where TOTP should be activated have a red cross.

This feature would increase the security a lot.
Because 2FA is an excellent way to prevent hackers (that have stolen usernames and passwords) break into the account.

Some entries in the 2FA-list have a red exclamation mark (a so called exception).
At these entries there are some specialiies.
You see many at the category Gaming (https://twofactorauth.org/#gaming).
For example Steam or Blizzard, that have own authenticator apps.

You find this data also in the JSON:
"exceptions":{"text":"Software implementation requires use of the Steam Mobile app. Authentication on non-phone devices is not officially supported. SMS support is limited to receiving account recovery codes for password resets."}},

This must also be considered by the KeePassXC (just show the exception text in a separate column).

[droidmonkey]

This is a very limited feature that would be rather complex to implement. I do not endorse this. We could simply add a link to the website for users to check themselves.

[OLLI-S]

In KeePassXC I have 969 entries and 697 have an URL entry.
Having to check all these 697 entries manual is a lot of work.

In KeePassXC you have 2FA (TOTP) already implemented, so you should increase the usability and add this feature, where users get a report of websites, that support TOTP but it is not yet set up.

The password manager 1Password has such a feature to increase the security of the password entries.
Here a screen show taken from the official website (https://1password.com/tour/):

LastPass suggests to protect the LastPass Account with 2FA "get stronger security":
https://blog.lastpass.com/2016/10/its-two-factor-tuesday-so-turn-it-on.html/

They also suggest to protect the entries in the password database with 2FA:
https://www.lastpass.com/two-factor-authentication

So this feature encourages users to activate 2FA for their password entries and helps them finding entries without 2FA.

[ArminWeb]

I would love such a feature, have also many entries where I have not yet added TOTP (simply because I did not know that the service offers it).

[droidmonkey]

I'll consider it, still a lot of work

[OLLI-S]

Would the source code of the HaveIBeenPwnd plugin for KeePass (https://github.com/andrew-schofield/keepass2-haveibeenpwned) help?
This is a similar task, it checks all URLs in KeePass against an API.

[OLLI-S]

I would donate 20 USD for this feature (if donating for a specific feature is possible)

[OLLI-S]

@droidmonkey I donated 30 USD for this feature, what do I have to do so this donation is shown here?
For security reasons I have not linked my GitHub and my Bountysource Account.

[droidmonkey]

It is showing on bounty source, not sure why the title wasn't changed: https://www.bountysource.com/issues/86453678-suggest-totp

[OLLI-S]

@droidmonkey The title must be changed and the "bounty" tag must be applied.
I did not do this because I thought this is an automated process.

[OLLI-S]

Thank you @droidmonkey
Now I hope that other users donate to this feature....

[OLLI-S]

In the past I also had a look at the password manger Bitwarden.
In Bitwarden I have some health reports, here you also have a report called Inactive 2FA report.
This report lists entries where 2FA is not yet set up but is available:

The fact that 1Password, Bitwarden and also other password managers have such a report shows, that this feature is important.

[andkopp]

I think this is quite a useful feature. KeePassXC would become more intelligent helping the user to get all accounts more secure where TOTP is available.

[OLLI-S]

@andkopp Would you like to donate for this feature (like I did)?
https://www.bountysource.com/issues/86453678-suggest-totp
Maybe someone implements this feature if the bounty is high enough.

[droidmonkey]

This would be an excellent addition to the health check after it is merged. Or even as a third page to the new "Reports" view.

[OLLI-S]

Thank you @andkopp for increasing the bounty!

@droidmonkey the title of this topic is not automatically updated, so could you please update the bounty value in the title?
Thank you!

[OLLI-S]

@droidmonkey I thought the subject is automatically updated when someone donates?

[droidmonkey]

Its supposed to

[OLLI-S]

@droidmonkey This feature is really important because it increases the security of my KeePassCX entries. And this is the reason why other password managers already offer this feature.
It is also requested by other users and there are also donations for this feature.

So how is the plan implementing this feature?
Can some parts of the code of other features (like the HIBP check) be used here (so that this feature is easier to implement)?

I really would love to see this feature in KeePassXC.
Is an increase of the bounty helping?

[droidmonkey]

It would be another tab on the reports view. I have no time for this feature it will have to wait or someone else can do it.

[wolframroesler]

Sounds interesting, and not too difficult once we have offline HIBP support (#551). Would use the v2 API, however (https://twofactorauth.org/api/v2/tfa.json).

[OLLI-S]

@wolframroesler, this sounds fantastic, I am very happy that this feature comes closer to be developed.
Maybe this is a feature for 2.7.0?
We will see...

[OLLI-S]

I have received an email from Have I Been Pwned alerting me that my email address was breached in the db8151dd breach.

In this email they write at the bottom:

So they point out how important it is to activate 2FA for all accounts.
😉

[OLLI-S]

Bitwearden fixed the bug that there are no entries shown in the Inactive 2FA report so now you see results (in the screen shot I just greyed out my usernames / my email address):

The links "Instructions" open the website with the instructions (how to set up 2FA).
This URL is also found in the Two Factor Auth List (https://twofactorauth.org/)

[OLLI-S]

I recognized that Bitwarden does not list all relevant entries form my demo vault (containing just 20 entries) in this report.
The reason is that stored URL contains additional information (in some cases also session IDs).

Here some URLs of Amazon.de that could be stored in KeePassXC:

• https://www.amazon.de/
• https://amazon.de/ap/signin
• https://smile.amazon.de/ap/signin
• https://www.amazon.de/ap/signin?ie=UTF8&clientContext=.... (much text was truncated here)

So you have to reduce the URL stored in KeePassXC to the domain + country information (amazon.de) and look up this value in the "Two Factor Auth List".

For Amazon I found in the "Two Factor Auth List" only Amazon.com (not .de) so I don't know what to do in these cases.

[shbach]

FYI https://twofactorauth.org/ needs to be replaced with https://2fa.directory/ when this is implemented.

[HexF]

I've started to work on this, here is what I currently I have working:

[droidmonkey]

I like it, I think this should be combined with the "change your password" links as well.