Refining 2FA login flow (one click less on most-used device)

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

I searched https://github.com/nextcloud/server issues for "is:issue is:open 2fa default" and did not find anything related, so…:

Situation

I need to select a 2FA challenge upon every login if multiple methods are set up. I assume that most users prefer one method and only have another method set up for rare use on other devices or as backup. Personally, I have a FIDO2 in my Laptop. But when I need to access the NC web interface from my mobile, I use TOTP.

Considerations

@ChristophWurst said to me that this was a decision made at some point as some 2FA methods immediately DO something as soon as they are selected/used (like sending an SMS). I vote against this as that was a user decision – either in terms of "used last time" or "user set it as default".

Related to https://github.com/nextcloud/server/issues/34406

Implications

It has to be decided upon whether to offer "last" (no UI change neccessary) and/or "default" (addition to user/settings necessary, probably implications on passwordless authentication flow).

Proposal

In the login screen, the user should be able to

a) immediately use the last/default 2FA method
b) select an alternative method

If "default" is implemented and the user selects an alternative method upon login, the user should be able to set the alternative method right there as new default.

That is what I see in GitHub, WordPress+Two-Factor (good screenshots), etc. It eliminates one click for all users that do have more than one method set up.

Notes

This is a starting point for a (focussed) discussion. Please challenge or enhance the proposal by pointing out what needs to be taken into consideration.

No implementation files, tests, or entry points are named. Start by tracing the existing 2FA login flow and reviewing the related issue 34406, then establish whether the project should support the last-used method, a user-selected default, or both; done requires an agreed proposal and defined behavior for alternative methods and passwordless authentication.