It would be useful if a user can have multiple totp devices (along with some sort of "display name"), so they can have it on multiple phones or similar
Should be easier with the refactoring done in T218210 etc
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Catrope | T230042 Allow multiple TOTP devices | |||
| Resolved | taavi | T242031 Allow multiple different 2FA devices | |||
| Resolved | Reedy | T268564 Convert OATHAuth to AbstractSchema | |||
| Resolved | taavi | T330502 Create oathauth_types and oathauth_devices tables | |||
| Resolved | Marostegui | T348693 Drop oathauth_users table from production |
Event Timeline
Comment Actions
I wonder if there should be a side/parent task for allowing multiple of anything (as appropriate)....
Comment Actions
I am going to close this as a duplicate of T242031: Allow multiple different 2FA devices because solving that will solve this.
Comment Actions
I don't think this is a duplicate as each module is in the charge of its own management form. T242031 (which is basically done) is about supporting multiple authenticators in the shared backend and login flow, but each module still has to decide how to display multiple authenticators.
Comment Actions
And introduce the concept of display names, so they can be differentiated from each other. And have some sort of a default display name (since the existing entries don't have one), maybe based on creation date.
Comment Actions
Change #1184593 had a related patch set uploaded (by Catrope; author: Catrope):
[mediawiki/extensions/OATHAuth@master] Allow multiple TOTP keys to be added when OATHAllowMultipleModules=true
Comment Actions
Change #1184593 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Allow multiple TOTP keys to be added when OATHAllowMultipleModules=true
Comment Actions
This is now allowed when $wgOATHAllowMultipleModules is set to true. For now it's set to false by default, but we'll turn this on soonish when we're ready.
Comment Actions
I have created T404029: Enable multiple 2FA modules in production to track the roll-out of this feature
Comment Actions
Change #1186530 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OATHAuth@master] TOTP: Fix logic for displaying TOTPEnableForm
Comment Actions
Change #1186530 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] TOTP: Fix logic for displaying TOTPEnableForm
Comment Actions
Change #1186548 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OATHAuth@wmf/1.45.0-wmf.18] TOTP: Fix logic for displaying TOTPEnableForm
Comment Actions
Change #1186548 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@wmf/1.45.0-wmf.18] TOTP: Fix logic for displaying TOTPEnableForm
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-09T18:40:54Z] <dduvall@deploy1003> Started scap sync-world: Backport for [[gerrit:1186548|TOTP: Fix logic for displaying TOTPEnableForm (T404091 T230042)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-09T18:46:41Z] <dduvall@deploy1003> dduvall, reedy: Backport for [[gerrit:1186548|TOTP: Fix logic for displaying TOTPEnableForm (T404091 T230042)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-09T19:09:13Z] <dduvall@deploy1003> Finished scap sync-world: Backport for [[gerrit:1186548|TOTP: Fix logic for displaying TOTPEnableForm (T404091 T230042)]] (duration: 28m 18s)
Comment Actions
I don't see much point in this. Can't the user merely synchronise their TOTP key in a credential manager, like Bitwarden (and countless others) provide?
Comment Actions
I don't see much point in installing yet more software (like a credential manager) on each device only to sync between devices.
Comment Actions
@Aklapper, device loss or failure. PCI DSS V4.0 and NIST guidance recommend them for a well-documented reasons.
Comment Actions
We're not handling payments, and we're trying to give users as much choice as possible. We can't force them to use magic cloud (or even setup their own local infrastructure) syncing apps.