Contributor chat (ibede)

[Jack-Edwards]

@ibede Thank you for all the good work you have done lately.

Let me know if there is anything I can do for you.

[ibede]

It's my pleasure. I always wanted to contribute to OSS - now I found some time and looked for areas where I have less experience, where I can gain some new knowledge. Cryptography and WebAssembly are such things so this repo seemed like a perfect match. Also your coding style is very close to mine so I got the overview quite fast. So I gladly contribute here as much as I can.

[Jack-Edwards]

@ibede I see you are looking for another issue to work on.

Would you be interested in implementing multi-factor authentication? This is something I began to work on last year, but I have not been able to find the time to complete it.

It looks like my work only included an option for emailed two-factor codes, but ideally the application should also support TOTP in case the user does not want to provide an email address.

Otherwise, the issue you commented on earlier is a good option.

[ibede]

Sure, I was considering the MFA as well, but I saw you were working on it and haven't found the issue for that - I thought it's your internal development. But I'd like to help with it.
What's the current status of the implementation? I saw this draft PR, shall I continue on that branch? If the email-code factor is already working maybe I start a new branch based on that.
Some technical/workflow questions:

• Should we integrate existing OTP implementation like Otp.NET, or implement it internally? Keys can be generated independently from the package. The dotnet-identity-embedded 2FA implementation is not an option as we don't use their identity model and SignInManager.
• I think the user shall be able to set their preferred MFA method, and also provide means for fallback mechanism.
• What's your idea for handling situations when the user has no more access to their MFA provider (like a lost mobile phone without fallback)? Account recovery may be an option, but should we provide MFA recovery separately?

[Jack-Edwards]

Created #786.

I'll reply over there.