It would be nice to add WebAuthN support for an account's security, which would support for :
- Passkeys (saved on mobile devices, Windows Hello, or password managers)
- Work both as 2FA and also a way to login ("Login with Passkey" button without even typing an email), and could also allow the user to delete their password to use Passkey only sign in
- Physical Security Keys (Yubikey, Google Titan key, etc)
- Work as 2FA only
This could make Puter accounts more secure (at least for people who set it up), and also, with Passkeys, make logging in quicker and easier.
Note: yes i do know i already made an issue about passkeys (#379) but this new issue is better and includes physical security keys.
Activity
15
jelveh6mo ago@mohnishbaker Assigned! Let us know if you need help
mohnishbaker6mo agoHi @Zac0511 , @jelveh ! I have completed the webAuthN implementation using 2FA, Passkey and singIn using passkey I was working on implementing the password-less signIn and remove the password implementation for that I had a few questions regarding that : 1). After removing the password should we give the option to add password instead of change password ? 2). If someone has 2FA enabled and has removed the password and tries to deactivate the 2FA what should be the case for that because 2FA requires password to be disabled ?
Thank you.
Zac05116mo agoHi @Zac0511 , @jelveh ! I have completed the webAuthN implementation using 2FA, Passkey and singIn using passkey I was working on implementing the password-less signIn and remove the password implementation for that I had a few questions regarding that : 1). After removing the password should we give the option to add password instead of change password ? 2). If someone has 2FA enabled and has removed the password and tries to deactivate the 2FA what should be the case for that ?
Thank you.
For 1, yes the change password button could become and add password button, for 2, 2FA could be disabled (since logging in via passkey most of the time also bypasses 2FA), as long as the passkey CANNOT be deleted if there is no password, or else the user would get locked out of their account.
mohnishbaker6mo agoSigned the CLA. Thank you.
Salazareo5mo agoHi @mohnishbaker thanks for the contribution, unfortunately we were in the middle of a big rewrite to our backend so your changes got caught in the middle.
could you port them over to new structure?
mohnishbaker5mo ago@Salazareo , Sure on it.
Salazareo2mo agogonna open this back up to community to add
Michelle-Ekw1mo agoHi @Salazareo could I pick up this ticket?
Salazareo1mo agoHi @Michelle-Ekw yes please, I'll assign it to you, let me know if you need any help
o0oke1mo agoany updates? any difference between admin/common account?
rowin-C1mo agoCould I pick this up ?
Michelle-Ekw1mo agoHey @rowin-C I just saw this was assigned to me. Let me take a look and if I decided to pass it on I'll let you know
Michelle-Ekw19d agoWorking on this now! I'm getting my environment fixed together
I would like to work on it please assign it to me. I am new to open source contributions please assign me any new issue if you feel I should work on this. Thanks I would really like to try and contribute. I have setup puter on my local.