Make TOTP (+ HOTP) verification possible **without OS** installed
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 6
Description
> It would be nice if we could have TOTP (+ HOTP) verification possible **without OS** by going through the OEM Factory Reset / Re-Ownership options. It would allow us to have solid root-of-trust from us (OEM) to the end user, even if no OS was chosen. A lot of users order Heads without OS.
> From our side, credentials are then separately delivered via different channels (physical paper, email and Signal). Ideally, credentials should be randomly generated.
_Originally posted by @wessel-novacustom in https://github.com/linuxboot/heads/discussions/1521#discussioncomment-9083965_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the OEM Factory Reset and Re-Ownership flows referenced in this issue, along with the linked discussion. Determine where TOTP/HOTP verification could operate without an installed OS and how credentials should be randomly generated and delivered. Done means the requirements and affected entry points are defined well enough to implement and verify the flow.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100