phpmyadmin / phpmyadmin/phpmyadmin
2FA: Recovery key?
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 7.9k
- Forks
- 3.6k
- Avg merge
- 4d 18h
- Merged PRs (30d)
- 36
Description
Unless I'm mistaken, there is no good way to recover a two-factor authenticated account if the user loses access to their app. The workaround for this is to have an administrative user manually edit the phpMyAdmin Configuration Storage to disable 2FA for that user.
Would it be worthwhile to provide a recovery key string that the user can enter to recover access to their account?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the existing two-factor authentication flow and the phpMyAdmin Configuration Storage, both mentioned in the issue. Determine the requirements and risks for a recovery key that restores access when the user loses the authenticator app. Done means the recovery approach is defined and the account can be recovered without administrative database edits.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100