Conversation
|
Excellent. But a separate proposal for U2F/WebAuthn? |
| Returns: `{"totp_key": "keyhere", "backup_keys": ["a", "b", "c"]}` | ||
|
|
||
| `DELETE /_matrix/client/r0/user/{user_id}/totp` | ||
| Remove TOTP from the account. Require password as a parameter (?) |
There was a problem hiding this comment.
Other services I've seen allow you to remove 2FA tokens without having to auth the 2FA (only requiring password for confirmation). Of course you do need to be logged in already.
There was a problem hiding this comment.
I think I've had the opposite experience, but can't name a service off-hand
There was a problem hiding this comment.
I think this endpoint should just require user interactive auth, like other security sensitive endpoints do. The server could then decide, if you need to provide the password, password+totp token, password+totp recovery key, or any other combination, just like the usual flows.
turt2live
added
the
needs-implementation
|
With the adoption of OAuth 2.0 based authentication API (MSC3861) I don't think the SCT will plan to further improve the Matrix-specific authentication APIs. With that in mind I'm going to put this up for closure. If the author wishes to close this they can do so directly at any point. @mscbot fcp close |
|
Team member @clokep has proposed to close this. The next step is review by the rest of the tagged people: Once at least 75% of reviewers approve (and there are no outstanding concerns), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up! See this document for information about what commands tagged team members can give me. |
mscbot
added
proposed-final-comment-period
github-project-automation
bot
moved this to Tracking for review
in Spec Core Team Workflow
turt2live
moved this from Tracking for review
to Ready for FCP ticks
in Spec Core Team Workflow
|
🔔 This is now entering its final comment period, as per the review above. 🔔 |
mscbot
added
final-comment-period
|
The final comment period, with a disposition to close, as per the review above, is now complete. |
mscbot
added
finished-final-comment-period
and removed
disposition-close
final-comment-period
tulir
added
rejected
9 participants
High level proposal for TOTP 2FA auth from @hawkowl
Rendered
SCT Stuff:
FCP closure tickyboxes
No MSC checklist