Multifactor authentication / WebAuthn support for logins

[Kristina Hoeppner]

Securing passwords becomes more and more important these days. Often, two-factor or multifactor authentication is used for that and requires either an app on a phone or a YubiKey.

There is a new way that looks promising, WebAuthn https://webauthn.io :

"The Web Authentication API (also known as WebAuthn) is a specification written by the W3C and FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. The API allows servers to register and authenticate users using public key cryptography instead of a password." https://webauthn.guide

This could be beneficial for the internal Mahara login. If SSO requires MFA or similar then that is handled by SSO.

[Kristina Hoeppner (kris-hoeppner)]

See https://moodle.org/plugins/tool_mfa for the new Catalyst Moodle plugin that might be of interest to check out in this context.