Two Factor Login (2FA) with TOTP

[jeyemwey]

Username and Password are no longer optimal protection for internet accounts. For a few years, Time-Based One-Time Passwords have become the de-facto standard to mitigate this.

We should use a library that provides the calculations. There are plenty of libraries out there, and we are not the first ones with this problem. The larger problem is to choose a good implementation /o\

Since we removed the login via API endpoint, it's okay to only provide the 2FA login in the web overview.

To be a good app, we should also:

• Allow for multiple second factors
• Show printable backup codes.

See also:

• Original discussion in GitHub Issues
• RFC 6238 -- TOTP: Time-Based One-Time Password Algorithm