4

I'd like to ask you if there are any possibilities of a two-factor authentication with authentication code sent to email. I've found TFA module which can send an SMS, and according to their documentation, also email:

The TFA code can be sent out over mobile phone SMS (recommended) or via email.

but I haven't found any settings for email, it seems they just provide "API to customize the communication chanel". I've also found Rules module, which could be maybe used combined with other module.

Are there any other possibilites how to do the two-factor authentication with email?

3

It looks like the recently posted OTP module supports emailing of its one-time passwords. It's still a sandbox project though and I haven't tried it myself.

It shouldn't be too difficult to add email support to the TFA module you mentioned. If you're interested in getting your feet wet with Drupal development, it might make a good starter project.

I suspect you would have to do some custom development to get Rules to handle generating of the codes. Either of the two options above would probably be quicker.

Maybe it's just an academic point, but keep in mind that by emailing the token, you're straying a bit from the idea of two-factor authentication, which entails "a knowledge factor ("something the user knows"), a possession factor ("something the user has")." The line gets a bit fuzzy already though, when you talk about logging in from your phone or forwarding text to a computer via services like Google Voice.

0

Was looking for the same security but without SMS/e-mail burden.So I developed the module and android app which will extend the login screen to 2-step authentication process and after successfully logged in with username/password in the second form user must enter TOTP code generated using module's companion android app Drulapp.

Module is not published yet at D.O but you can install module from https://drulapp.org .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.