Welcome to Codidact Meta!
Codidact Meta is the meta-discussion site for the Codidact community network and the Codidact software. Whether you have bug reports or feature requests, support questions or rule discussions that touch the whole network – this is the site for you.
Comments on Can we have second-factor sign-in authentication via e-mailed one-time codes?
Post
Can we have second-factor sign-in authentication via e-mailed one-time codes?
I realize that this might be a bit of a niche use case, but I'm going to put it out here anyway.
The availability of 2FA via an authenticator app is a great boost to account security.
However, there are still people who don't have smartphones, or who might not be willing to tie their smartdevice to their account here for some reason. For a not entirely unreasonable example, their smartphone might be a work-provided device where policy restricts what it can be used for.
I don't expect that this would be at the top of the list of priorities by any means, but since Codidact can already send e-mails (see for example the subscription feature), would it be possible to have second-factor authentication via an e-mailed one-time code?
I imagine that when set up, after successfully authenticating with one's password, an e-mail would be sent to the address associated with the account, containing a short code that must be entered before being signed in, and that this would happen each time the user signs in (not just when the attempt looks "suspicious" according to some metric – I suspect this would make the feature easier to implement).
Having that would mean that an attacker would need to gain access both to one's Codidact credentials, as well as one's e-mail account; and that such access would need to be ongoing (unless the attacker turns off the sign-in code requirement, which the legitimate account holder would notice no later than the next time they sign in and aren't prompted for a code).
1 comment thread