0

I'm implementing TOTP in my application to allow users to use two factor authentication with Google authenticator and the like.

However I've also implemented "social login" using OAuth, should the users be prompted for their TOTP codes when logging in with those OAuth accounts as well? (Given that users might already be using 2FA on that service the login experience could become cumbersome)

0

Depends what you want to achieve. When using "social login" you are delegating user security responsibility to a third party (well, in a way to your user as in most of these authentication sources 2FA is optional). If you want your service access to be MFA protected, then you should not be even allowing OAuth

  • Could you please elaborate why I should not be allowing OAuth for login and offer multi factor authentication to the users? – NanoBob Feb 8 at 14:07
  • Ok, here is my point of view. You want MFA, so you want strong security. You want social login, so you want user comfort. You cannot be sure if your user logging in using Facebook has the account protected with MFA - there is no API to check it. So you cannot allow only social login. You can add MFA after Oauth takes place and ask for TOTP. But imagine your user already hase the Facebook account with MFA enabled. In this case, the user will have to provide 3 set of credentials: facebook password, facebook OTP and OTP of your system - this is not very user-friendly. – Emin Feb 9 at 17:19
  • I understand your point, however I'm looking at it from the user's point of view, it would be in the user's best interest to have the option to use TOTP if they so desire. So what I think I am going to do, is have a user setting of whether or not they want to use two factor when logging in with OAuth. – NanoBob Feb 10 at 22:15
  • @NanoBob , just an addendum, seems like with Google you can check whether 2FA is enabled : developers.google.com/admin-sdk/reports/v1/reference/… – Emin Feb 11 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.