Improve Workflow for 2nd Factor Authentication

Problem to solve

When I change my smartphone, I have to completely disable U2F in order to see a QR-Code for the authenticator app. This is very cumbersome as I use both the authenticator app (Google Authenticator, in my case) and Yubikey and have to set up both devices again even when just replacing one (Smartphone). A button "Change authenticator app" is missing.

image

Streamlining the new setup of an Authenticator App by allowing a replacement of the current authenticator app instead of just allowing disabling it along with any associated Yubikeys.

Intended users

Any users who use both a U2F and an authenticator app who replace their authenticator app.

Further details

Proposal

Adding a new function which displays the same qr code as on setup, but upon successful entering of confirmation number simply replaces the current authenticator secret (I guess there is a secret stored for the qr code in the database) with the new secret.

Alternatively, I would love to be able to use several authenticator apps at the same time (maybe giving them an arbitrary label similar to U2F keys).

Permissions and Security

Documentation

Testing

What does success look like, and how can we measure that?

Links / references

Assignee Loading
Time tracking Loading