Implement token-based 2FA authentication

[LiquidPL]

Branching this off #2862, as it's now related to the client-specific stuff.

We should have an option for users to use a TOTP-based two-factor authentication method, in addition for the current, email-based one.

[r1bnc]

Any update on this? It is annoying to get the code via Email everytime. It woul d be easier to just implement 2FA using TOTP.

[peppy]

There's no update, no. If there was an update it would be posted in this issue.

[alixdotsh]

Commenting about this...

Using a 2FA app like Authy would be a good option for others, it’s also more convenient to do. So if people are not getting codes via email they atleast have a second option to choose from, like a 2FAS app.

iirc it can still be the same codes we get through email (hybrid of numbers and letters) using Authy or any other app for 2FAS authentication.

[r1bnc]

I'm not a fan of Authy, i just want to see the secret code in a qr code (or manual) then input that to something like Google Authenticator and use that code to generate Time based One Time Password (TOTP) that has 6 digits and 1 minute of expiry.
There are a lot of sample PHP projects with OTP functionality.

Honestly, logging in to my e-mail just to confirm my login is a PITA. If you are wondering, the email provider does permit IMAP/SMTP access, that is why it is a PITA. And no, I am not switching email.

[LiquidPL]

I'd like to take a stab at implementing this. Is anyone working on it currently or is it free to take?

[peppy]

has not been started yet; go for it!

[LiquidPL]

Just to make sure, we want both a token prompt when logging in if you have 2fa/totp enabled like on other websites, and also for it to replace the email verification in other places we use it, right?

Also would like to know if we want to give people an option to fallback to email if they lose their authenticator, or not.

[peppy]

I would have the fallback to email available for now, yes. We can decide to turn that off based on user feedback (or make it a toggle) in the future, but initial goals should be to improve convenience, not security (and support overhead after people lock themselves out).