Diffusion Phabricator (master) History

phabricator/src/applications/auth/factor
master

Aug 8 2019

9bd74dfa6c07 Autofocus the "App Code" input on the TOTP prompt during MFA gates after login
Author
epriestley
Revisions
D20703: Autofocus the "App Code" input on the TOTP prompt during MFA gates after login
Browse Repository
Passed
No Audits

Mar 5 2019

920ab13cfb86 Correct a possible fatal in the non-CSRF Duo MFA workflow
Author
epriestley
Revisions
D20234: Correct a possible fatal in the non-CSRF Duo MFA workflow
Browse Repository
Passed
No Audits

Feb 15 2019

2ca316d652d8 When users confirm Duo MFA in the mobile app, live-update the UI
Author
epriestley
Revisions
D20169: When users confirm Duo MFA in the mobile app, live-update the UI
Browse Repository
Passed
No Audits

Feb 7 2019

f2236eb061a6 Autofocus form control for adding TOTP codes
Author
amckinley
Revisions
D20128: Autofocus form control for adding TOTP codes
Browse Repository
Passed
No Audits

Feb 5 2019

03eb989fd875 Give Duo MFA a stronger hint if users continue without answering the challenge
Author
epriestley
Revisions
D20088: Give Duo MFA a stronger hint if users continue without answering the challenge
Browse Repository
Passed
No Audits

Jan 31 2019

e9b2d667ee57 Improve handling of "Deny" responses from Duo
Author
epriestley
Revisions
D20065: Improve handling of "Deny" responses from Duo
Browse Repository
Passed
No Audits

1767b80654fe Replace manual query string construction with "phutil_build_http_querystring()"
Author
epriestley
Revisions
D20053: Replace manual query string construction with "phutil_build_http_querystring()"
Browse Repository
Passed
No Audits

Jan 29 2019

9fd8343704ee Bring Duo MFA upstream
Author
epriestley
Revisions
D20039: Bring Duo MFA upstream
Browse Repository
Passed
No Audits

Jan 28 2019

29b4fad94173 Get rid of "throwResult()" for control flow in MFA factors
Author
epriestley
Revisions
D20035: Get rid of "throwResult()" for control flow in MFA factors
Browse Repository
Passed
No Audits

bce44385e1e3 Add more factor details to the Settings factor list
Author
epriestley
Revisions
D20034: Add more factor details to the Settings factor list
Browse Repository
Passed
No Audits

8e5d9c6f0eb5 Allow MFA providers to be deprecated or disabled
Author
epriestley
Revisions
D20031: Allow MFA providers to be deprecated or disabled
Browse Repository
Passed
No Audits

Jan 24 2019

c9ff6ce390d6 Add CSRF to SMS challenges, and pave the way for more MFA types (including Duo)
Author
epriestley
Revisions
D20028: Add CSRF to SMS challenges, and pave the way for more MFA types (including Duo)
Browse Repository
Passed
No Audits

Jan 23 2019

7805b217ad8b Prevent users from editing, disabling, or swapping their primary contact number…
Author
epriestley
Revisions
D20023: Prevent users from editing, disabling, or swapping their primary contact number while they have SMS MFA
Browse Repository
Passed
No Audits

ada8a56bb7db Implement SMS MFA
Author
epriestley
Revisions
D20022: Implement SMS MFA
Browse Repository
Passed
No Audits

6c11f373965c Add a pre-enroll step for MFA, primarily as a CSRF gate
Author
epriestley
Revisions
D20021: Add a pre-enroll step for MFA, primarily as a CSRF gate
Browse Repository
Passed
No Audits

f3340c633562 Allow different MFA factor types (SMS, TOTP, Duo, ...) to share "sync" tokens…
Author
epriestley
Revisions
D20020: Allow different MFA factor types (SMS, TOTP, Duo, ...) to share "sync" tokens when enrolling new factors
Browse Repository
Passed
No Audits

bb20c136513c Allow MFA factors to provide more guidance text on create workflows
Author
epriestley
Revisions
D20017: Allow MFA factors to provide more guidance text on create workflows
Browse Repository
Passed
No Audits

0fcff782533a Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA…
Author
epriestley
Revisions
D19975: Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA Factors"
Browse Repository
Passed
No Audits

Jan 16 2019

a62f334d9503 Add a skeleton for configurable MFA provider types
Author
epriestley
Revisions
D19935: Add a skeleton for configurable MFA provider types
Browse Repository
Passed
No Audits

Dec 28 2018

1729e7b46792 Improve UI for "wait" and "answered" MFA challenges
Author
epriestley
Revisions
D19908: Improve UI for "wait" and "answered" MFA challenges
Browse Repository
Passed
No Audits

3da9844564cf Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Author
epriestley
Revisions
D19898: Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Browse Repository
Passed
No Audits

Dec 20 2018

b63783c06718 Carry MFA responses which have been "answered" but not "completed" through the…
Author
epriestley
Revisions
D19895: Carry MFA responses which have been "answered" but not "completed" through the MFA workflow
Browse Repository
Passed
No Audits

ce953ea44790 Explicitly mark MFA challenges as "answered" and "completed"
Author
epriestley
Revisions
D19894: Explicitly mark MFA challenges as "answered" and "completed"
Browse Repository
Passed
No Audits

657f3c380608 When accepting a TOTP response, require it respond explicitly to a specific…
Author
epriestley
Revisions
D19893: When accepting a TOTP response, require it respond explicitly to a specific challenge
Browse Repository
Passed
No Audits

0673e79d6d96 Simplify and correct some challenge TTL lockout code
Author
epriestley
Revisions
D19890: Simplify and correct some challenge TTL lockout code
Browse Repository
Passed
No Audits

Dec 18 2018

46052878b1de Bind MFA challenges to particular workflows, like signing a specific Legalpad…
Author
epriestley
Revisions
D19889: Bind MFA challenges to particular workflows, like signing a specific Legalpad document
Browse Repository
Passed
No Audits

Dec 17 2018

b8cbfda07ce6 Track MFA "challenges" so we can bind challenges to sessions and support SMS…
Author
epriestley
Revisions
D19886: Track MFA "challenges" so we can bind challenges to sessions and support SMS and other push MFA
Browse Repository
Passed
No Audits

c731508d748a Require MFA implementations to return a formal result object when validating…
Author
epriestley
Revisions
D19885: Require MFA implementations to return a formal result object when validating factors
Browse Repository
Passed
No Audits

Dec 14 2018

080fb1985f29 Upgrade an old "weakDigest()" inside TOTP synchronization code
Author
epriestley
Revisions
D19884: Upgrade an old "weakDigest()" inside TOTP synchronization code
Browse Repository
Passed
No Audits

Nov 7 2018

8a4bf386552f Use 160-bit TOTP keys rather than 80-bit TOTP keys
Author
epriestley
Revisions
D19792: Use 160-bit TOTP keys rather than 80-bit TOTP keys
Browse Repository
Passed
No Audits

Oct 1 2018

4858d43d1601 Add 'autocomplete="off"' to MFA TOTP inputs
Author
epriestley
Revisions
D19722: Add 'autocomplete="off"' to MFA TOTP inputs
Browse Repository
Passed
No Audits

Oct 9 2017

9bd6a3705559 Fix spelling
Author
0
Revisions
D18693: Fix spelling
Browse Repository
Failed
No Audits

Apr 6 2017

3d816e94dfbe Rename "PhabricatorHash::digest()" to "weakDigest()"
Author
epriestley
Revisions
D17632: Rename "PhabricatorHash::digest()" to "weakDigest()"
Browse Repository
Passed
No Audits

Jul 26 2016

29d6e5fd4bae Use numeric input control for TOTP factor entry
Author
fooishbar
Revisions
D16325: Use numeric input control for TOTP factor entry
Browse Repository
Passed
No Audits

Jul 24 2016

020df6f5cb80 Add a numeric input control for TOTP codes
Author
epriestley
Revisions
D16323: Add a numeric input control for TOTP codes
Browse Repository
Passed
No Audits

Mar 16 2016

33a95d44bdc7 Formally modularize MFA/TOTP tokens, provide a module panel for temporary tokens
Author
epriestley
Revisions
D15479: Formally modularize MFA/TOTP tokens, provide a module panel for temporary tokens
Browse Repository
Passed
No Audits

a837c3d73eaf Make temporary token storage/schema more flexible
Author
epriestley
Revisions
D15478: Make temporary token storage/schema more flexible
Browse Repository
Passed
No Audits

Sep 14 2015

0449a07f537d Add `bin/auth unlimit` and clean up a TODO
Author
epriestley
Revisions
D14105: Add `bin/auth unlimit` and clean up a TODO
Browse Repository
No Builds
No Audits

Sep 1 2015

29948eaa5bd2 Use phutil_hashes_are_identical() when comparing hashes in Phabricator
Author
epriestley
Revisions
D14026: Use phutil_hashes_are_identical() when comparing hashes in Phabricator
Browse Repository
No Builds
No Audits

Jul 7 2015

f695dcea9ee8 Use PhutilClassMapQuery
Author
joshuaspence
Revisions
D13429: Use PhutilClassMapQuery
Browse Repository
No Builds
No Audits

Jun 15 2015

1239cfdeaf3a Add a bunch of tests for subclass implementations
Author
joshuaspence
Revisions
D13272: Add a bunch of tests for subclass implementations
Browse Repository
No Builds
No Audits

May 22 2015

36e2d02d6ec5 phtize all the things
Author
joshuaspence
Revisions
D12797: phtize all the things
Browse Repository
No Builds
No Audits

Feb 10 2015

2a0af8e2995d Add email invites to Phabricator (logic only)
Author
epriestley
Revisions
D11723: Add email invites to Phabricator (logic only)
Browse Repository
No Builds
No Audits

Jan 6 2015

f2e87aad89e9 Rename the `PhabricatorAuthFactorTOTP` class for consistency
Author
joshuaspence
Revisions
D11191: Rename the `PhabricatorAuthFactorTOTP` class for consistency
Browse Repository
No Builds
No Audits

May 20 2014

cac61980f904 Add "temporary tokens" to auth, for SMS codes, TOTP codes, reset codes, etc
Author
epriestley
Revisions
D9217: Add "temporary tokens" to auth, for SMS codes, TOTP codes, reset codes, etc
Browse Repository
No Builds
No Audits

May 1 2014

e14695821758 Generate QR codes for TOTP tokens
Author
epriestley
Revisions
D8923: Generate QR codes for TOTP tokens
Browse Repository
No Builds
No Audits

Apr 28 2014

a017a8e02b51 Make two-factor auth actually work
Author
epriestley
Revisions
D8886: Make two-factor auth actually work
Browse Repository
No Builds
No Audits

17709bc1674e Add multi-factor auth and TOTP support
Author
epriestley
Revisions
D8875: Add multi-factor auth and TOTP support
Browse Repository
No Builds
No Audits