2fa (two factor authentication) request

KeepCoolCH

Hi Karl
With my little user registration project i got the idea of a two factor authentication while login. Usernames and passwords can easily be hacked. I think a 2fa function (for example QR-Code via authenticator app like google authenticaor or duo) would be nice to integrate. If you need a sample for a script, i did put one together without the need of an external library. ;-) But until now i didn't integrate it to my user registration sample.
Thanks for your opinion on that idea.

Karl

KeepCoolCH It's interesting of course, especially for those with high security requirements. I don't personally like the idea much, because it's difficult to squeeze into a "single file" PHP gallery, and even after 2FA login, it's still just session based PHP login. I personally prefer to use Cloudflare and built-in server mechanisms, although this is not always appropriate for multiple "unknown" users.

KeepCoolCH Usernames and passwords can easily be hacked.

When you say "easily be hacked", what do you mean by this? If you use a strong password, there is no reason to assume it can easily be hacked.

I'm definitely not against it.

KeepCoolCH

Karl Thank you for your thoughts. With easily hacked i meant there is no timelimit that a hacker could brute force the login data, because there is no way to lock the attacker out after a few failed loginattempts. With a 2fa it would be nearly impossible to figure out the limited timebased code.

Here is the sample, which i put together: Download 2fa-sample
Here you can try it our: Try 2fa-sample

With ?action=add_user you can add a user, then it shows you the qr-code for the authenticator app. Then when you login you have to fill in the 2fa code or you could manage the users with ?action=dashboard.

The only thing i didn't implement was, that you could show the qr code while you're not logged in and the user.json is not secured in any way. So that would be a thing to change here also.

Karl

KeepCoolCH Here is the sample, which i put together: Download 2fa-sample
Here you can try it our: Try 2fa-sample

That's cool 🤩 Didn't know it could be done with so little code. I will possibly look into this later.

KeepCoolCH With easily hacked i meant there is no timelimit that a hacker could brute force the login data, because there is no way to lock the attacker out after a few failed loginattempts. With a 2fa it would be nearly impossible to figure out the limited timebased code.

Yes of course 2FA is ultimately secure, since the user needs to populate a time-sensitive password, after providing the correct login details. My only post was that a "strong" password, is normally sufficiently secure, even with "brute force" attacks. Files Gallery also uses session tokens rendered in javascript, so it's limited how frequently "brute force" attacks could be triggered anyway. This is another reason I personally use Cloudflare, because it could easily block brute force attacks, even if they could be achieved somehow ...

But yes, these days one can never be paranoid enough, so 2FA could be a nice feature.

Anubhav

I agree and would like to see this feature in future release, no hurry but certainly a quality suggestion. Thanks

KeepCoolCH

Update!

I did implement the 2fa for myself. A separate adminpanel is needed to generate users and to get the QR-code for the registered user. It was really simple with a few lines of code in the files.gallery index.php. The new code-lines are marked as // === NEW: xxxx ===.

The index.php is based on the standard files.gallery version 0.12.4. That means you won't find the additional features of the user registration from my other project.

You can download the index.php and adminpanel.php here: Download

If you want to test it for yourself:
Login to the filebrowser: Filebrowser filey.gallery
Login to the adminpanel: Adminpanel
Username: admin
Password: admin

Important note: PLEASE DON'T DELETE THE ADMIN USER OR CHANGE NAME/PASSWORD IN THE EXAMPLE ON MY SERVER OR REGENERATE AN OTHER QR-CODE, OTHERWISE OTHERS CAN'T TEST IT BECAUSE OF THE NEW QR-CODE.

You have to scan the QR-code with an authenticator app like Google Authenticator or Duo Mobile or any other authenticator app on your phone to get the 2fa code:

The normal filebrowser login site has now an additional field:

When you download the files and install it on your server the adminpanel ask you to create an admin user. With this it adds the following lines to the config.php from the user:

'2fa_secret' => 'IFFAPY4SAWVJXXCM', 'isadmin' => true,

For a normal user it only adds the line 2fa_secret' => 'IFFAPY4SAWVJXXCM',

After set up the admin user, the QR-code for the admin is shown, which you also need to login to the admin panel.

I hope you like it. Ask me, if you have any questions! 🙂