google / google/google-authenticator-libpam

Multiple secrets

Open
#174 7 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

Hey there!
Typically one generates a fresh secret and adds it to an authenticator App or even some hardware TOTP device. An individual might have several codes for each machine/role they might want to log in as. It can also be shared among team members and so.
However there's also some sort of inverse case: each person has a single secret, typically because they have a single hardware device (per person) so having a new secret per account is a bad idea. In this case it would be awesome if .google_authenticator file could have a list of secrets and attempt to validate them all. As long as one works it can proceed to login.
There's some caveats like: what if there's a few hundreds of secrets? Well it might be slow. Even worse *some* of them might be valid by chance increasing the chances of an attacker to log in, not great.

Can you please at least give it a thought? Or perhaps suggest some alternatives?

Thanks a lot!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.