Ability to share code with another Ente Auth user

[vishnukvmd]

Either this could be long-lived (where we share the secrets themselves), or timed (where we share the generated codes for the next X minutes).

These two are separate requests, but creating a single discussion for now so folks can share their thoughts.

[ekadin-mtc]

On self-hosted (which is what I'm running), I imagine this would require some form of user management?

[maroofmedia]

Personally, I wouldn’t need or use such a feature, as it seems to introduce unnecessary security risks. The whole point of two-factor authentication (2FA) is to ensure that only the intended user has access to their accounts by requiring a second form of verification. Sharing 2FA codes, whether they are long-lived secrets or timed codes, undermines this security principle.

If you’re sharing codes with another person, it defeats the purpose of having a second authentication factor in the first place. The goal of 2FA is to create a barrier that only the legitimate user can cross, so allowing others access to these codes compromises the integrity of that barrier. For these reasons, I believe it’s crucial to maintain strict control over 2FA codes and avoid any sharing that could potentially expose accounts to greater risk.

[ekadin-mtc]

I'm not sure why sharing would undermine the security principle? Instead of only the intended user having access, now it is the intended users .
There are times when there is a need to have a shared login to an account, whether with family members or with co-workers. If one would like to add 2FA to those accounts, they would need a way of sharing the 2FA code. Currently, the options that I know of is for one person to get the code and sharing it via email, sms, phone call or the like. This is definitely a security concern, as no one should get in the habit of sharing codes on the manner. The other option would be to add the 2FA to a password manager that supports it. That leads to an issue of "putting all your eggs in one basket". One could share the secret key which each person can add to their auth app, however, this creates an issue if access needs to be revoked or changed.
I believe having the option to share the secret with other users within Ente is the perfect solution. This way only legitimate and intended users get access, and the code does not need to be shared each time. Access can then revoked as needed and any changes get propagated to all users immediately.

[ekadin-mtc]

@vishnukvmd I see the timed sharing of codes was implemented! It looks great!

Is there an option to share through a self-hosted server? Currently, the sharing is done through auth.ente.io even when sharing from a self-hosted instance.

Has there been any further discussion on long-lived sharing?

[ua741]

Is there an option to share through a self-hosted server? Currently, the sharing is done through auth.ente.io even when sharing from a self-hosted instance.

In the current implementation, as every data that is required to display the the codes is part of the URL, we didn't consider self-hosting use-case separately. The current implementation also works for offline mode.

In the future, if we decide to increase the time to share the codes, we will probably reconsider the implementation, and add support for self-hosting during that iteration.

[anon221218]

Has any further thought been put into persistent shared codes (preferable via groups)?

The ability to create shared groups, assign tokens(codes) to them (ideally like adding labels functionality), and assigning users who should have access to these groups is an important part of a credential management system. (as well as logging, so maybe shared codes don't display unless clicked, to facilitate a future logging capability)

Since very few websites allow for multiple MFA credentials (let alone FIDO tokens) to be saved, and since it's quite common (especially in business) to need to share site credentials within groups (since not all websites allow users/teams), or with family where more than one person may need to access something (utilities, financials, shopping, delivery notification, etc), this leaves either copy/sharing the seed to multiple devices, putting the seed in a password manager (arguably breaking the 2FA purpose unless using a second password app) or shut off the extra MFA to allow access... The problem with putting the seed on each device means not having the ability to update them and have them propagate. Yes, this does create a revoking issue since we shared the seed, but you can just disable/enable MFA on the site and you get a new seed... (not that most people actually handle shared credentials properly anyways on staffing changes)