Can 2FA / MFA be secure & functional in a purely offline state (PWA)?

Question

I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other stuff.

The idea has been proposed to add 2FA to the offline login to make it "more secure". However, my (limited) understanding of MFA tells me that I'd have to store the 2FA secret key locally, and this code could be retrieved and probably be used to reverse engineer the auth code, making the whole thing moot.

(For the sake of argument, let's pretend this isn't JavaScript and a malicious actor can't just "skip" past my login process to access the app offline without logging in.)

Am I correct in my assumption that this is a dead-end? Or is there a way to do 2FA purely offline in a secure manner? Is there a better way to approach this?

Answer 1

Authentication against a local JS application does not work. I wrote a detailed answer on this topic before. The crux of the argument is that an attacker is in complete control over the mechanism that performs the authentication, and is therefore able to always authenticate themselves successfully.

What about Multi-Factor Authentication?

It will not fare any better. Imagine a simple scenario, in which your application would send an SMS token to your user, once they entered the correct password. An attacker can simply read out which value is expected, and enter that value.

But what if an attacker would not be able to skip past my login?

That's the problem. In any even remotely realistic scenario, you don't get to tell the attacker how they can attack your application.

An offline JavaScript application can't securely authenticate a user, because the attacker is completely in charge of the authentication process.