2FA authorization in modals

[banocean]

Useful for actions like resetting configuration or running something that invokes all members

[Hyperclaw79]

Call me paranoid but, this looks nothing short of an account stealer lol....

[AlmostSuspense]

A proper implementation would only return a boolean (or even nothing at all), the code wouldn't be sent to the application but to Discord, which would then either let the bot know if it's valid or not, or prevent the modal from being submitted at all if it's not

This also allows bots to enforce the server side 2FA requirement, which can currently be bypassed using bots as only the bot owner needs to have 2FA and not the user executing a command (which in this case would perform moderation actions)

[Hyperclaw79]

While it sounds good on an open source bot, there's still a chance for phishing on closed sourced ones.
The users of the bot may not be tech savvy.
Imagine one link going to an external site which "requires" Discord authentication which triggers an interaction webhook to make the Modal popup, which will ask for the 2FA to continue.
It's a double-edged sword which can abused if the bot dev knows his stuff.
If Discord implements something like an encrypted password input field, then this can be safely implemented. But that would probably require some effort on the backend side as well.

[VelvetToroyashi]

While what suspense mentioned seems like a far more sane solution/implementation, I personally can't think of anything a user would do outside of OAuth2 that would prompt for a 2FA code. Even bots with [mass-]moderation functionality have limited ability over a server and its members, especially when you take into consideration ratelimits.

Assuming this isn't just a shitpost (the idea seems incredibly asinine even on a surface level), I'm curious to know what legitimate use case could come out of this.

[AlmostSuspense]

Imagine one link going to an external site which "requires" Discord authentication which triggers an interaction webhook to make the Modal popup, which will ask for the 2FA to continue.

That's not how interactions work, interactions are only created by user actions (using a slash command, clicking a button and the likes). they can't be programatically created. And as mentioned in my previous mesage, Discord wouldn't return your 2FA code itself but either whether it was valid or not, or nothing at all depending on how its implemented

I personally can't think of anything a user would do outside of OAuth2 that would prompt for a 2FA code.

Enforcing the 2FA server-side requirement, or any actions that might have a large impact

[BotDevPanda]

I actually like this idea but also agree with @Suspense4615. For safety measures, the code would not be shared with anybody but instead would return a boolean to the developer if it's correct or not. Or Discord could always return true. Instead, the client would notify the user saying the code was incorrect and to try again, therefore we would always get true

[MidSpike]

I'd support this if and only if bot developers are not involved in any chain of the process apart from

1. Bot asks discord to display a mfa prompt to user within the discord client
2. Discord asks the user to complete an mfa prompt (app codes for some people, email codes for others)
3. Discord sends the bot (true|false), that is the only info that a bot should receive.
4. Bot decides to (A) proceed with spicy action, (B) Not proceed

A real world use-case I can see would be if a user uses a bot to perform a destructive (or not easily reversible) action

[AlmostSuspense]

Discord could just not let your modal go through if you havent filled the 2FA code, so no 2fa data would ever be sent to the app

[imranbarbhuiya]

I agree that discord can send a boolean. But a dev can create a model showing
enter discord Auth code. Everyone won't verify that the prompt is from bot or discord as both are coming after a user action like clicking button on submitting the model. Doing like this can cause security issues.

[Hyperclaw79]

Exactly my concern @imranbarbhuiya

Moreover, the whole point of using 2FA in commands is to prevent compromised accounts from using the commands right?
But if an account with 2FA enabled got compromised in the first place, there's a high chance that they have the means to get the 2FA code as well. Which totally defeats the purpose of enforcing it in a command.

But if we're using it just for the sake of confirmation, something like "Type the command name to confirm" should suffice.

[AlmostSuspense]

I mean that's basically already possible, text inputs already can do that