[GH-ISSUE #100] Security issue with 2fa module set #80

New issue

Closed

opened 2026-02-25 21:34:06 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 21:34:06 +03:00

Owner

Originally created by @jasonmunro on GitHub (Aug 1, 2016).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/100

The 2 factor authentication module set has a security flaw. It uses the same shared secret for all users of a site - making it possible for another user on the same site to generate the TOTP pin required for login. My plan to fix this is:

use pbkdf2 to combine the site secret with the username to create a unique TOTP key per user.
disable 2fa on accounts that have it enabled by changing the setting name, and prompting them to re-add the png barcode of the shared secret and re-enable 2fa, which will update their authentication app.
build logic around "versioning" of settings (This came up WRT to some other potential security issues, and could be a useful way for modules to maintain backwards compatibility in situations like this).
build support for 3 2fa emergency codes for case like this (and for other situations like losing your 2fa device).

Originally created by @jasonmunro on GitHub (Aug 1, 2016). Original GitHub issue: https://github.com/cypht-org/cypht/issues/100 The 2 factor authentication module set has a security flaw. It uses the same shared secret for all users of a site - making it possible for another user on the same site to generate the TOTP pin required for login. My plan to fix this is: - use pbkdf2 to combine the site secret with the username to create a unique TOTP key per user. - disable 2fa on accounts that have it enabled by changing the setting name, and prompting them to re-add the png barcode of the shared secret and re-enable 2fa, which will update their authentication app. - build logic around "versioning" of settings (This came up WRT to some other potential security issues, and could be a useful way for modules to maintain backwards compatibility in situations like this). - build support for 3 2fa emergency codes for case like this (and for other situations like losing your 2fa device).