2 factor auth by sending key to messager (Threema, WhatApp)?

[benni85]

OpenVPN AS currently supports 2FA in combination with Google Authenticator. Most users are even today using end2end encrypted Messaging Tools like Threema / WhatsApp?.
Wouldn't it make sense to provide Integration of AS with for example Threema API so that the Server can send second Auth factor to a user's messenger app?

[David Sommerseth]

We are researching and evaluating SAML support in OpenVPN Access Server. This moves the authentication layer out of OpenVPN to any Identity Providers (IdP) supporting SAML, which we believe is a more sane way to handle authentication these days. We do not have any timelines currently of when such a feature would be available.

With that said, even though Threema/WhatsApp? _may_ use encryption for such messages, using this kind of text based authentication is not considered optimal compared to offline methods such as TOTP and HOTP. More information on this topic can be found here:

• ​https://www.theverge.com/2017/9/18/16328172/sms-two-factor-authentication-hack-password-bitcoin
• ​https://www.forbes.com/sites/thomasbrewster/2017/09/18/ss7-google-coinbase-bitcoin-hack/#6927a9fd41a4
• ​https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/
• ​https://www.howtogeek.com/310418/why-you-shouldnt-use-sms-for-two-factor-authentication/

[novaflash]

Just reviewing and closing old tickets that were left open in the community site, although these were already copied into our internal tracking system and handled there.

Implementation of SAML is happening at this moment. It is expected that somewhere this year this function will become available. In SAML there are many ways to deal with this. Because of the limited choices in resolution type on this tracking system I will consider this as fixed-external, as we are handling this in our internal issue tracking system and not handling this here on the public community tracking system.