I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and at the moment, that secret is being encrypted using the users password within a database field. We don't store the password itself but the hash of the password and use it to compare to the users submitted password at run time for comparison.
I'm now realizing that there's a flaw in this methodology and that's when the user forgets their password and requests a password change. At that point, we've no way of decrypting the users secret (using their old password) so that we can re-store the secret using the submitted new password.
I was wondering how others deal with this? To my mind we have the following choices:
- We force the user to set up their mobile app again with a new secret
- We encrypt the secret, not to the users password, but to another form using another encryption string
I guess that (1) is the easiest but not the best for the user - they'd have to remove their (former) account from the app before scanning a QR code (or equivalent) to set up a new account.
(2) I like the idea of, but wonder how we should go about that. I thought of perhaps taking a hash of the users email address and using that as the encryption string as we can programmatically restore everything without the users password, but not sure that's secure enough?
Can anyone give me some guidance here as to where to look for possible solutions?