#106 - MFA - adam/gate - forge: foundry. beyond coding. we forge.

EkiciLP commented

2025-09-03 07:50:38 -05:00

(Migrated from github.com)

Is your feature request related to a problem? Please describe.
There is no type of MFA available decreasing security for password based users

Describe the solution you'd like
I'd personally like TOTP but I'm sure there others wanting SMS and Email based MFA too.

Describe alternatives you've considered
Passkeys I guess but not everyone wants or can uses them.

**Is your feature request related to a problem? Please describe.** There is no type of MFA available decreasing security for password based users **Describe the solution you'd like** I'd personally like TOTP but I'm sure there others wanting SMS and Email based MFA too. **Describe alternatives you've considered** Passkeys I guess but not everyone wants or can uses them.

👍 5

ZingyAwesome commented

2025-09-03 09:56:57 -05:00

(Migrated from github.com)

To add to this, I would love to be able to use a password as the first factor and then one of my security keys over WebAuthn as the second factor. If this is added then I'd be happy to switch from Authelia which is a bit overkill for my setup.

👍 3

notquitenothing commented

2025-09-03 18:52:13 -05:00

(Migrated from github.com)

Thank you for opening an issue, I appreciate your suggestion!

I am not opposed to adding alternate forms of MFA, the current solution would be to use a passkey only account for extra security. VoidAuth does request MFA user verification from passkey providers: either a PIN code, device login, or biometrics. How much verification happens entirely depends on the passkey provider. Unfortunately, no amount of MFA will be more secure than the password reset, which requires only access to the users email account.

I do believe passkeys are the future, most of my users end up activating a passkey using their default device password manager (FaceID, Windows Hello, etc.) though users can instead use a 3rd-party provider like BitWarden or a hardware key with potentially multiple forms of identity verification if their passkey provider supports it. Most passkey providers also have the convenience of passkey syncing, and QR codes for onboarding new passkey devices.

I am going to add more functionality to the user profile page to help facilitate passkey management like removing passkeys, converting to a passkey-only account, etc. Stay tuned for that as I think it will smooth out passkey usage somewhat. I am going to leave this issue open for discussion, as I think more MFA options could be a great addition even though it is not currently on the roadmap 🙂

Thank you for opening an issue, I appreciate your suggestion! I am not opposed to adding alternate forms of MFA, the current solution would be to use a passkey only account for extra security. VoidAuth does request MFA user verification from passkey providers: either a PIN code, device login, or biometrics. How much verification happens entirely depends on the passkey provider. Unfortunately, no amount of MFA will be more secure than the password reset, which requires only access to the users email account. I do believe passkeys are the future, most of my users end up activating a passkey using their default device password manager (FaceID, Windows Hello, etc.) though users can instead use a 3rd-party provider like BitWarden or a hardware key with potentially multiple forms of identity verification if their passkey provider supports it. Most passkey providers also have the convenience of passkey syncing, and QR codes for onboarding new passkey devices. I am going to add more functionality to the user profile page to help facilitate passkey management like removing passkeys, converting to a passkey-only account, etc. Stay tuned for that as I think it will smooth out passkey usage somewhat. I am going to leave this issue open for discussion, as I think more MFA options could be a great addition even though it is not currently on the roadmap 🙂

ZingyAwesome commented

2025-09-04 09:51:22 -05:00

(Migrated from github.com)

I'm not a huge fan of passkeys as they are implemented by most devices right now. In my opinion they represent a form of vendor lock-in. Most passkey providers do not let you export passkeys you have created which can be imported to another provider. You could argue that the lock-in is a security feature because once the passkey is created, the private key cannot be exported which means it cannot be phished/hacked or something along those lines. However it hinders the recovery process if you lose access to your passkey provider. Let's say my house burned down and I lost all my devices (which is not outside the realm of possibility). Any accounts I had that used a passkey exclusively would be toast since my hardware keys would be dead. I do not wish to store passkeys in my password manager as it's an 'all your eggs in 1 basket' scenario and feels to me like a downgrade from 2FA. Typically I store passwords in my password manager and separate the 2nd factor, either TOTP from an app or WebAuthn from my hardware security keys if the site supports it.

For me the ideal situation is to use a password for the first factor. This gets backed up with my password manager vault. The second factor would be WebAuthn with the option to fall back to one-time use recovery codes. That way I can store those recovery codes in an encrypted offsite backup so even if I do lose all my hardware security keys, I will never lose access to the account as I can just pull the recovery code from my backup.

As VoidAuth already supports passkeys and passwords separately I would really love to see an option to combine them with passkeys being the 2nd factor 👍

I'm not a huge fan of passkeys as they are implemented by most devices right now. In my opinion they represent a form of vendor lock-in. Most passkey providers do not let you export passkeys you have created which can be imported to another provider. You could argue that the lock-in is a security feature because once the passkey is created, the private key cannot be exported which means it cannot be phished/hacked or something along those lines. However it hinders the recovery process if you lose access to your passkey provider. Let's say my house burned down and I lost all my devices (which is not outside the realm of possibility). Any accounts I had that used a passkey exclusively would be toast since my hardware keys would be dead. I do not wish to store passkeys in my password manager as it's an 'all your eggs in 1 basket' scenario and feels to me like a downgrade from 2FA. Typically I store passwords in my password manager and separate the 2nd factor, either TOTP from an app or WebAuthn from my hardware security keys if the site supports it. For me the ideal situation is to use a password for the first factor. This gets backed up with my password manager vault. The second factor would be WebAuthn _with the option to fall back to one-time use recovery codes_. That way I can store those recovery codes in an encrypted offsite backup so even if I do lose all my hardware security keys, I will never lose access to the account as I can just pull the recovery code from my backup. As VoidAuth already supports passkeys and passwords separately I would really love to see an option to combine them with passkeys being the 2nd factor 👍

👍 2

notquitenothing commented

2025-09-04 23:41:38 -05:00

(Migrated from github.com)

I do like the idea of MFA+ through password + passkey. You could potentially get 3FA with password, device passkey, and bio-metrics 😲. I do want to reemphasize that passkeys are already 2FA (because VoidAuth requests them that way from passkey providers). That may be something I look into, though I couldn't say when.

I do think you could get around the issue of passkey-only vendor lock-in and potential loss of access through device loss/failure by having multiple passkeys through different passkey providers on your account. There is no limit to the number of passkeys you can have, though it is impractical to add more on a passkey-only account. Right now the only way to add them on a new device is by logging in with a password, but I am working on making that a bit easier right now 🙂

I do like the idea of MFA+ through password + passkey. You could potentially get 3FA with password, device passkey, and bio-metrics 😲. I do want to reemphasize that passkeys are already 2FA (because VoidAuth requests them that way from passkey providers). That may be something I look into, though I couldn't say when. I do think you could get around the issue of passkey-only vendor lock-in and potential loss of access through device loss/failure by having multiple passkeys through different passkey providers on your account. There is no limit to the number of passkeys you can have, though it is impractical to add more on a passkey-only account. Right now the only way to add them on a new device is by logging in with a password, but I am working on making that a bit easier right now 🙂

Svenito commented

2025-09-23 15:12:22 -05:00

(Migrated from github.com)

I would second support for otp support for rotating tokens generated by Aegis or google authenticator for example.
I am also not a big fan of passkeys for above reasons

I would second support for otp support for rotating tokens generated by Aegis or google authenticator for example. I am also not a big fan of passkeys for above reasons

👍 3

wailord284 commented

2025-10-10 20:13:15 -05:00

(Migrated from github.com)

Just wanted to also put in a +1 for additional MFA options. Really enjoying VoidAuth so far but would love if I could use more 'traditional' rotating tokens with a authenticator app. It'd be cool if you could also mandate MFA for a user or allow them to bypass it.

👍 3

notquitenothing commented

2025-11-08 16:21:42 -06:00

(Migrated from github.com)

Working on this currently. An initial implementation will probably not require a user to enable MFA, but allow them to on their profile.

Future enhancements would include requiring users/groups to create an MFA (and allowing them to do so if they have not) and requiring access to specific OIDC Clients/ProxyAuth Domains to include MFA.

Working on this currently. An initial implementation will probably not require a user to enable MFA, but allow them to on their profile. Future enhancements would include requiring users/groups to create an MFA (and allowing them to do so if they have not) and requiring access to specific OIDC Clients/ProxyAuth Domains to include MFA.

🎉 3

notquitenothing commented

2025-11-30 14:26:13 -06:00

(Migrated from github.com)

MFA Support through TOTP Authenticators and Passkeys has been released in v1.5.0. While I mentioned that an initial implementation would be missing some functionality I went ahead and did it all anyways 😂 This release includes MFA requirement through global environment variable (MFA_REQUIRED), group membership, and OIDC Clients/ProxyAuth Domains which can be toggled on their respective admin pages. If a user is required to use MFA to continue and they have not set it up before, they will be able to on the MFA page after an initial password login.

I consider this issue closed unless problems with the implementation pop up. If you find any bugs or or have any related feature requests, please open a new issue and I will look at it!

MFA Support through TOTP Authenticators and Passkeys has been released in [v1.5.0](https://github.com/voidauth/voidauth/releases/tag/v1.5.0). While I mentioned that an initial implementation would be missing some functionality I went ahead and did it all anyways 😂 This release includes MFA requirement through global environment variable (MFA_REQUIRED), group membership, and OIDC Clients/ProxyAuth Domains which can be toggled on their respective admin pages. If a user is required to use MFA to continue and they have not set it up before, they will be able to on the MFA page after an initial password login. I consider this issue closed unless problems with the implementation pop up. If you find any bugs or or have any related feature requests, please open a new issue and I will look at it!

🎉 1

Rows
Columns

MFA #106