google / google/google-authenticator-libpam
Multiple secrets
- Dominant language
- C
- Stars
- 2k
- Forks
- 305
- PR merge metrics
- No merged PRs in 30d
Description
Hey there!
Typically one generates a fresh secret and adds it to an authenticator App or even some hardware TOTP device. An individual might have several codes for each machine/role they might want to log in as. It can also be shared among team members and so.
However there's also some sort of inverse case: each person has a single secret, typically because they have a single hardware device (per person) so having a new secret per account is a bad idea. In this case it would be awesome if .google_authenticator file could have a list of secrets and attempt to validate them all. As long as one works it can proceed to login.
There's some caveats like: what if there's a few hundreds of secrets? Well it might be slow. Even worse *some* of them might be valid by chance increasing the chances of an attacker to log in, not great.
Can you please at least give it a thought? Or perhaps suggest some alternatives?
Thanks a lot!
Contributor guide
Assessment
This issue has not been assessed yet.