Add support to yubikeys and U2F as additional MFA methods
marcioalm opened this issue · comments
Is your feature request related to a problem? Please describe.
The MFA method implemented in ghostwriter is a huge step in securing the application. However, its not the most secure method since it can still be phished via tools like evilginx3 etc. Implementing U2F and hardware token MFA guarantees that credentials to ghostwriter can't be phished this way.
This feature request is mostly a "nice to have" feature that will greatly improve the security of some deployments.
Describe the solution you'd like
Add yubikeys and U2F (totp) as additional MFA methods in ghostwriter. This method of MFA is a lot more secure than conventional MFA methods since they are virtually unphishable.
The following library seems to already provide this functionality: https://django-otp-yubikey.readthedocs.io/en/latest/
This issue has been labeled as stale because it has been open for 30 days with no activity.