allow user to generate a printout sheet of emergency one-time passwords

[Ricardo Kirkner]

User story:

As a SSO user, I want to generate a sheet of 10 valid tokens wwhich I can print out and keep in a safe place so that I can access my account in an emergency.

Details:

Add a way for an user to generate a printout sheet with 10 valid one-time passwords.

Related work include:

- generate multiple OTP and associate them to the users account
- invalidate each used password after the first successful login (possibly keep them around with the date they were used)
- indicate the status of the passwords in the user's account detail page (used/unused)
- allow user to invalidate set of OTP (in case he lost the printout sheet)

[Stuart Metcalfe (stuartmetcalfe)]

See related notes in bug #911951

[Selene ToyKeeper (toykeeper)]

Could we bump up the importance on this? As more of the company starts using 2F auth, people are getting locked out more often. There have been 4 such cases in the past day (though this is higher than usual).

I'd like to tell users that they should use paper as a backup auth method, but very few are willing to do it manually. It'd be much nicer if SSO could give them a printable page and take care of the key and sequence counter on its own.

I suspect this would require some relatively shallow UI changes, a new page for the users to print, a new auth device type almost identical to the generic type, and an extra field in the database to keep track of where the sequence counter should be on the print-outs.

To help users keep their passcode sheets in order, it would be nice to indicate the sequence counter somehow. A couple ways to do it are to say "OTPs #50-99" at the top of the sheet, or perhaps just prefix each passcode with its counter like "57: 123456". This could also eliminate the need to store the highest-printed counter in the database, if users have a way to track it themselves, and would allow them to print a sheet twice if desired.