Allow TOTP auth methods to be named
Closed, ResolvedPublic
Actions

Description

Since we plan to support multiple TOTP apps on the same account, we should allow users to give them a name, like we already do for WebAuthn methods.

On the form for setting up a TOTP app, add a step between "Step 1: Download a 2FA program" and "Step 2: Scan the QR code" for inputting a name
Renumber the other steps accordingly
Display the name of each TOTP app the user has registered on Special:AccountSecurity

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Allow TOTP auth methods to be named	Reedy	mediawiki/extensions/OATHAuth	REL1_45	+45 -14
	Allow TOTP auth methods to be named	Mstyles	mediawiki/extensions/OATHAuth	master	+45 -14

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Open		None	T399644 FY2025-26 WE4.6.2 Multiple Authenticators
		Resolved		Mstyles	T401772 Allow TOTP auth methods to be named

Event Timeline

Catrope created this task.Aug 13 2025, 4:43 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 13 2025, 4:43 AM

Chlod subscribed.Aug 13 2025, 7:22 AM

Catrope updated the task description. (Show Details)Aug 14 2025, 5:33 PM

Mstyles claimed this task.Aug 14 2025, 9:10 PM

Mstyles edited parent tasks, added: T399644: FY2025-26 WE4.6.2 Multiple Authenticators; removed: T242031: Allow multiple different 2FA devices.Aug 20 2025, 6:59 PM

Catrope triaged this task as Medium priority.Aug 20 2025, 9:02 PM

Reedy moved this task from Backlog to User Experience on the MediaWiki-extensions-OATHAuth board.Aug 26 2025, 11:20 AM

Would it makes sense to pre-fill this with something generic ("authenticator app") for the user's first TOTP key, to reduce friction? (The names will eventually be editable, right?) Or make it clearly optional?

In T401772#11151390, @Tgr wrote:

Would it makes sense to pre-fill this with something generic ("authenticator app") for the user's first TOTP key, to reduce friction? (The names will eventually be editable, right?) Or make it clearly optional?

While I haven't considered the LOE involved in changing that, this sounds like a very sensible idea to me. And we could also just default all the names (e.g. "authenticator app 2") for now. In fact I'm not sure it makes sense to ask the user to enter a value at all, if they won't be able to edit it in the MVP we're rolling out.

We'll probably end up with a bunch of "authenticator app 1" style names anyway, because we need to assign some kind auto-generated name to the keys that have been created in the past.

Catrope moved this task from Backlog to Consider for future work on the FY2025-26 WE4.6.2 Multiple Authenticators board.Sep 29 2025, 5:29 PM

Catrope added a project: Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)).Sep 29 2025, 10:14 PM

Catrope edited projects, added: FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support); removed: FY2025-26 WE4.6.2 Multiple Authenticators.Oct 2 2025, 4:11 AM

Catrope moved this task from Inbox to UX cleanup on the FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support) board.Oct 2 2025, 6:18 PM

Catrope moved this task from Priority backlog to Ready on the Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)) board.Oct 2 2025, 6:30 PM

Mstyles moved this task from Ready to Priority backlog on the Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)) board.Oct 2 2025, 6:30 PM

Mstyles moved this task from Priority backlog to Ready on the Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)) board.

Mstyles moved this task from Ready to In progress on the Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)) board.Oct 15 2025, 6:04 PM

OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)); removed: Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)).Oct 20 2025, 2:29 PM

OKryva-WMF moved this task from Backlog to In progress on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Oct 20 2025, 2:29 PM

AAlhazwani-WMF unsubscribed.Oct 20 2025, 2:36 PM

A_smart_kitten awarded a token.Oct 24 2025, 6:18 PM

In T401772#11151390, @Tgr wrote:

(The names will eventually be editable, right?)

+1 to the names being editable - otherwise, for anyone that's currently added more than one authenticator app (and can currently remember which is which), they presumably won't be able to give them more descriptive names without removing & re-adding them.
(Also, if someone e.g. changes phone in a way that allows them to transfer the data stored by their authenticator app, a previously-entered name may end up no longer being accurate - e.g., someone might originally name an app "Authy on iPhone 13", which then wouldn't be accurate if they upgraded to an iPhone 15.)

In T401772#11307840, @A_smart_kitten wrote:

In T401772#11151390, @Tgr wrote:

(The names will eventually be editable, right?)

+1 to the names being editable - otherwise, for anyone that's currently added more than one authenticator app (and can currently remember which is which), they presumably won't be able to give them more descriptive names without removing & re-adding them.
(Also, if someone e.g. changes phone in a way that allows them to transfer the data stored by their authenticator app, a previously-entered name may end up no longer being accurate - e.g., someone might originally name an app "Authy on iPhone 13", which then wouldn't be accurate if they upgraded to an iPhone 15.)