Two Factor Authentication in SMF 2.1

Started by Dragooon, December 03, 2014, 03:05:27 PM

Previous topic - Next topic

Dragooon

Hello all!

It's been a steady two weeks since we released the first beta of SMF 2.1 and since then we've had mostly positive feedback I think, we have fixed a few bugs and did a few improvements marching towards Beta 2 and a part of that was Two-Factor Authentication which I implemented over last week.

Two Factor Authentication adds an additional layer of security over your usual username and password, it works by pairing a device using a compatible app to your account which would then be required whenever you wish to log-in again into the forums. This allows security against those who even managed to steal your username/password, blocking them off as long as they don't have the paired device. For more technical details of the implementation, have a look at the original pull request. SMF 2.1 is compatible with apps listed on the Wikipedia entry here, allowing you to pair with any one app of your preference.

Admins get the option to disable, enable (default) and force 2FA for all users. Although I personally would not recommend forcing 2FA for all since it does require a separate dedicated device but if you wish for that, the option is available. If you're impatient you can checkout GitHub master right now and see it in action (Not recommended for production) or wait for Beta 2 and further releases. With SMF 2.1 we have juiced up the security by a good margin, hopefully you'll like that.

I've attached a few screenshots of it in action, subject to change. These are from the latest build as of this post and I was using Authy for Android as a client but I couldn't take it's screenshots since it wouldn't allow me.

Thank you!

vbgamer45

Nice! Great idea thanks for adding it to 2.1 first forum software that I know of that has it!
Community Suite for SMF - Take your forum to the next level built for SMF, Gallery,Store,Classifieds,Downloads,more!

SMFHacks.com -  Paid Modifications for SMF

Mods:
EzPortal - Portal System for SMF
SMF Gallery Pro
SMF Store SMF Classifieds Ad Seller Pro

Arantor

Very much approve of implementing TOTP 2FA.

Kindred

Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

CountryLady


Colin

"If everybody is thinking alike, then somebody is not thinking." - Gen. George S. Patton Jr.

Colin

engrz


ziycon

Fair play, I'm liking security being given the attention it deserves.

Deaks

sounds good specially for any user with advanced access of any form that can be a potential security issue
~~~~
Former SMF Project Manager
Former SMF Customizer

"For as lang as hunner o us is in life, in nae wey
will we thole the Soothron tae owergang us. In truth it isna for glory, or wealth, or
honours that we fecht, but for freedom alane, that nae honest cheil gies up but wi life
itsel."

saosangmo

Love you so much. I have used SMF for 8 years and this is the best software in security.

Masterd

Excellent news! SMF is really moving in the right direction. :)

Antes

Perfect to see security improvements in software.

Quote from: saosangmo on December 07, 2014, 12:26:39 PM
Love you so much. I have used SMF for 8 years and this is the best software in security.

We love you too for being with us for such long time :)

Powerbob




My SMF 2.1 Beta test site; http://www.pplb.net/smf21/index.php

karlbenson


stmaxx

sorry I'm late,  BUT this looks Great!

regards,
maxx

hadesflames

I see the admin is able to force 2FA on everyone. I can see how that might be useful, depending on the type of forum you're running. But what would be even more useful is to be able to force 2FA on certain membergroups. For example, I wouldn't force it on all members on my forums, but I certainly would force it on Admins. I might also consider forcing it on membergroups with a lot of permissions, like global mods. So, I think an important feature to add would be to allow forcing of 2FA on different membergroups.

Kindred

unlikely to happen as a core feature....

that's a fairly niche request
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

Steve

That's a shame. This is the first time I've read this thread and I thought the same thing as hadesflames ... it would be even better to force it on certain membergroups instead of or in addition to being able to select everyone.
DO NOT pm me for support!

Arantor

I'd be in favour of it as a core feature.

LiroyvH

I can understand the need for such a feature, both from a perspective of security as user friendliness.
I'd be in favor as well. Up to the devs though. :)
((U + C + I)x(10 − S)) / 20xAx1 / (1 − sin(F / 10))
President/CEO of Simple Machines - Server Manager
Please do not PM for support - anything else is usually OK.

Advertisement: