Remember device

[PeopleInside]

Hi,
will be nice to be able to trust for a custom editable day value trusted device so the two step code are not required always on trust device. Should exist an option to reset all safe device to be 0 again for "resume security".

I have seen this work in the plugin WordPress 2-step verification

Great plugin

[heyjoecampbell]

+1

[kasparsd]

Would this be cookie based where we simply not require the second factor if the "remember me" cookie is present?

[PeopleInside]

Hi @kasparsd I do not know... in the plugin i mentionated you have a function (once logged) to remove trusted devices. If this will be based only to a cookie should exist a way to maybe decide on the website to disable that cookie... i mean if there are a security issue should be a way to login into the system and remove the trusted device so the two step will be asked again on those devices.

[heyjoecampbell]

Would using cookies enable administrators the ability to view and deactivate trusted devices?

Also, how long would a device be trusted (30 days) and can the timeframe be configured by the administrator?

[alanef]

Is this being worked on by anyone?

[kasparsd]

@alanef I'm not aware of anyone working on this right now.

[kasparsd]

The default WP "Remember Me" feature should be working. Here is how we're forwarding the rememberme checkbox to the second factor check:

https://github.com/georgestephanis/two-factor/blob/ea5c3f005da08e7619e5d839d5bbd06e3f545bcf/class.two-factor-core.php#L372-L375

Or is this about a feature similar to Google's trusted devices?

[PeopleInside]

I want password on WordPress is requested and is skipped two factor on a secure device. Remeber username and password and keep the session always active is not the best secure way.

[claytoncollie]

Greetings @alanef @kasparsd @heyjoecampbell @PeopleInside

Are any of you working on this feature? I think remembering the device would be a nice addition over the standard WP rememberme. Seems to me like we want to save the device in the database and allow the user and/or admin to remove those devices similar to Google's trusted devices.

Is that the concensus?

[PeopleInside]

@claytoncollie I think is this, yes.

[alanef]

Yes I already have this in the security plugin I'm developing, using device fingerprinting to warn users of unknown devices. It records the 'trusted' device footprint in user meta.

I think this should be fairly to use a hook to hook into 2FA to not ask to the 2nd factor is the device is trusted.

[claytoncollie]

@alanef that sounds cool. Are you going to submit a PR with your code?

[alanef]

I don't think it would be architecturally correct to 'pollute' the 2FA code with 'fingerprinting' functionality ( otherwise it starts to become a broader security system ), that is why I was thinking of hooking in to 2FA. When I get round to looking in detail, at where to hook in ( or extend a class? ) I may then need to submit a PR to facilitate the linking.