Implementing multiple multi-factor authentication (e.g. multiple security keys and authenticator)

[dorianmariecom]

good idea? anyone wants to pair program?

[sonalkr132]

Hi dorianmariefr, it would be great if you could be a bit more detailed about your idea. How would it help users? What problems with the existing system would it solve? What would the user flow be?
I am interested in getting yubikey support shipped, however, the PR seems cold #2108 If you are interested, you can brush it up and resubmit as well.

[dorianmariecom]

it would be great if you could be a bit more detailed about your idea.

I want to setup 2FA to secure my rubygems account, but only one method is supported, e.g. I have to choose my primary security key, my backup security key and my authenticator app

It would be nice to not lose my rubygems account if I lose my primary security key for instance (I know there are backup codes but I could lose them as well).

How would it help users?

It would encourage users to have secure account without risking losing their account

What problems with the existing system would it solve?

I can only have one multi factor method, e.g. can't have a backup security key for instance

What would the user flow be?

Same as google, twitter, facebook, github, etc. you would add an optional authenticator and optional security keys via webauth or otp not sure

I am interested in getting yubikey support shipped, however, the PR seems cold #2108 If you are interested, you can brush it up and resubmit as well.

thanks a lot for the PR link, I see it's based on the https://github.com/cedarcode/webauthn-ruby gem

not sure how it would interact with logging from the command-line when publishing a gem

[sonalkr132]

only one method is supported
can't have a backup security key for instance

Sorry, it is still not clear what would be this second/backup method. would it be the ability to register multiple devices? You should be able to use the same QR code to register multiple devices even now. If you use Authy, it also supports backup.

not sure how it would interact with logging from the command-line when publishing a gem

pypi already supports this. you could check how they are doing it.

[dorianmariecom]

yes, I would like to register google authenticator, and multiple yubikeys