feat(security): add account recovery backup codes #90

New issue

Open

opened 2025-10-05 14:22:20 +00:00 by chartgerink · 0 comments

chartgerink commented

2025-10-05 14:22:20 +00:00

Owner

In the future, we can add recovery backup codes, which are consumed upon use. This would require:

A separate backup codes table
Relevant endpoints (for example, to create the backup codes, to restore and consume a code, to create new backup codes – this is not a complete list)
A backup code generation process (what should the codes look like to begin with? Memorable or random? English or multilingual? this is not immediately obvious regrettably)
an exploration of additional considerations in this case

Currently, when a client activates 2FA, there is no way to recovery path for themselves. This inevitably will happen to someone, and this can be overcome by talking to an admin (who will have to do due dilligence). In the future, we can add recovery backup codes, which are consumed upon use. This would require: - A separate backup codes table - Relevant endpoints (for example, to create the backup codes, to restore and consume a code, to create new backup codes – this is **not** a complete list) - A backup code generation process (what should the codes look like to begin with? Memorable or random? English or multilingual? this is not immediately obvious regrettably) - an exploration of additional considerations in this case