Implement 2FA about pursuance HOT 4 OPEN

I don't think you can encrypt that secret in that way, as you will need it to authenticate them.

valid := totp.Validate(passcode, key.Secret())

I believe you will want to just store it as is.

from pursuance.

@ajvb What I'm saying is:

1. Go server starts up
2. We securely, interactively give it a long passphrase (using gopass, or maybe it tries grabbing its passphrase over SSL from a key server of course that will only let our servers grab their passphrase if we click "Yes let this server grab its passphrase" on a dashboard of ours?) that Go uses to generate a miniLock key pair (exactly like LeapChat does from the passphrase in the URL hash) -- and we give it the same passphrase every time
3. Go uses the public key half of that key pair to encrypt each 2FA secret it generates
4. Those 2FA secrets are stored encrypted on disk
5. When Go needs a user's 2FA secret it (a) grabs it off disk, (b) decrypts it, and (c) uses it

Then if someone hacked the server or cloned its HD, they'd need to scrape the secret key from RAM in order to decrypt each user's 2FA secret.

Think that makes a meaningful difference, security-wise? If so, think it's worth the additional hassle/complexity?

from pursuance.

@elimisteve Could we get our hands on servers with an HSM?

from pursuance.

@ajvb Not sure yet. The downside there is that data we've encrypted with the HSM cannot be moved to a different server/we can't create useful backups of it that we can use elsewhere, which concerns me.

from pursuance.