A fresh second factor for sensitive actions, and the phone as that factor (push approval) issue #356 closed: completed andymccall opened this 3 days ago · 0 comments

Policies that need a fresh second factor, and the phone as that factor (the app side is oxygenhub-android#32):

• Step-up policies: actions that need a second factor within the last N minutes, set by the site (admin changes, secrets, deleting a repository, adding keys or tokens) and per repository or organisation (landing into a protected bookmark, approving a guarded run, changing protection). The API answers such a request with a clear "second factor needed" and a challenge; the web asks inline and retries.
• Phone authenticators: register a phone's Keystore public key against the account; list and remove them in Settings › Security.
• Push approval: web sign-in with a registered phone sends a sealed alert with a challenge; the web page shows a number, the phone shows three and signs the right one. The sign-in waits, with TOTP offered alongside.
• An organisation can require a second factor (TOTP or a phone) of its members.
• The audit log records each step-up and approval; throttling as for TOTP.
• Tests: a policy blocks without a fresh factor and passes with one; a wrong number or a replayed challenge fails.