MFA Device Replacement Flow

[kevinlinxc]

Currently, if a user wants to change MFA devices, they have to disable MFA and add a new MFA device.

In the future, when MFA for a user cannot be disabled (for users with required mfa), disabling->enabling won't be an option, as there would necessarily be a state where the user has disabled MFA.

I've collaborated with some people to make a prototype to address this, and it boils down to:

1. User clicks a button in settings to start
2. They verify with their existing OTP, this sends them to a new MFA setup page that is on a 5 minute time limit
3. They set up their new MFA device, recovery codes like normal

Demonstration:

https://user-images.githubusercontent.com/44324811/178588968-b34b02b0-d672-4dad-aa65-35e95e572a70.mp4
(The first and last part are showing that you can only access the replacement page with verification)

Prototype code is here: Shopify#22

Feedback is welcome, especially vis-à-vis the placement/look of the starting button as that seems a bit unnatural right now.

[kevinlinxc]

@simi @sonalkr132 If you have time, could you have a look at this? It would be a "nice to have" if, when mfa is required, people could change their mfa device.

[simi]

@kevinlinxc seems ok to me 💪. Feel free to open PR so we can do review in here.

[sonalkr132]

there would necessarily be a state where the user has disabled MFA.

what happens if user loses their mfa device and recovery keys? As of now, we disable their mfa manually using disable_mfa script. I am guessing the script will continue to work. I am hoping mfa required users will be able to register new device if their mfa is disabled.

[simi]

@jenshenny is there still plan to contribute this feature? If I understand it well, this is still an issue as described for users not able to disable MFA, even today could be bypassed by using security device. It is still possible to disable TOTP today, but could be prevented in the future.

[jenshenny]

It's still on my radar. With the introduction of security devices, the flow would probably need to be changed. If a MFA req user tries to disable their last MFA device, they should be prompted to setup a TOTP or security device. That being said, this is my mental model of how the MFA settings should look like (I can chip away at it).

1. The MFA settings should be in their own page (like API keys) separate from edit settings
2. When someone accesses MFA settings, they will be prompted to MFA (like entering pw for API keys) if they have it setup

• we can then eliminate needing to MFA to update your MFA level and disable your TOTP

3. If a user doesn't have any devices there will be a create a MFA device page where a user can set up webauthn or totp.

• this page can be used in a "replace a device" flow.