{"action":"created","issue":{"url":"https://api.github.com/repos/wmlele/devise-otp/issues/24","labels_url":"https://api.github.com/repos/wmlele/devise-otp/issues/24/labels{/name}","comments_url":"https://api.github.com/repos/wmlele/devise-otp/issues/24/comments","events_url":"https://api.github.com/repos/wmlele/devise-otp/issues/24/events","html_url":"https://github.com/wmlele/devise-otp/issues/24","id":97767133,"number":24,"title":"Workflow changes","user":{"login":"jonathansimmons","id":945202,"avatar_url":"https://avatars.githubusercontent.com/u/945202?v=3","gravatar_id":"","url":"https://api.github.com/users/jonathansimmons","html_url":"https://github.com/jonathansimmons","followers_url":"https://api.github.com/users/jonathansimmons/followers","following_url":"https://api.github.com/users/jonathansimmons/following{/other_user}","gists_url":"https://api.github.com/users/jonathansimmons/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathansimmons/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathansimmons/subscriptions","organizations_url":"https://api.github.com/users/jonathansimmons/orgs","repos_url":"https://api.github.com/users/jonathansimmons/repos","events_url":"https://api.github.com/users/jonathansimmons/events{/privacy}","received_events_url":"https://api.github.com/users/jonathansimmons/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-07-28T18:12:36Z","updated_at":"2015-09-21T12:23:56Z","closed_at":null,"body":"In using this gem I've made some workflow changes that I think are critical to the core of this gem. I'm going to list them out here, with my reasons for the change. @wmlele if you would provide your feedback on each so I can determine which are worth taking the time to make a pull request for. \r\n\r\n### Change how devise_otp is enabled\r\n\r\n#### Problem\r\nTo me it's odd that I can enable the otp flag in the db without confirming a token. What this means is that if I just visit `/users/otp/token` and choose enable then sign out. I'm locked out of my account. \r\n\r\n#### My Fix\r\nWhat I do is modify the views so that the user is displayed an token field and must submit a valid TOTP token to activate otp. Example\r\n\r\n<img width=\"1258\" alt=\"screen shot 2015-07-28 at 1 01 25 pm\" src=\"https://cloud.githubusercontent.com/assets/945202/8939231/cc52ab96-3528-11e5-8015-99d315e79a9f.png\">\r\n\r\n==============\r\n\r\n### Don't require TOTP token on credential refresh\r\n\r\n#### Problem\r\nRequiring a token on credential refresh just feels cumbersome. I remove this code in every case that I've use it. Modeling more after github which only requires that you re-enter your password \r\n\r\n#### My Fix\r\nJust remove the necessity for a TOTP token during credential refresh. \r\n\r\n==============\r\n\r\n### Allow the browser to be trusted when providing a TOTP token during login. \r\n\r\n#### Problem\r\nRight now you can only trust a browser once signed in. If I miss that though it would be nice to be provided with the option to trust the browser as I sign in. \r\n\r\n#### My Fix\r\nAdd a \"Trust this browser\" checkbox to the token form during signup. Example \r\n\r\n<img width=\"572\" alt=\"screen shot 2015-07-28 at 1 09 50 pm\" src=\"https://cloud.githubusercontent.com/assets/945202/8939429/f91598c2-3529-11e5-9b4c-553def4ada1f.png\">\r\n\r\n==============\r\n\r\n### Consider a backup account recover option\r\n\r\n#### Problem\r\nIf a user in my app contact me because they can't access their account and don't have an recovery token, at the moment I can only take them at their word and unlock their account. \r\n\r\n#### Proposed Fix Options\r\n- We could request a backup email during activation which would be used for an application administrator to send a token to.\r\n- We could implement the twilio gem to allow the user to provide a sms number to receive a backup token. \r\n\r\n==============\r\n\r\n@wmlele I have codes solutions for some of these already. Just wanted to get your thoughts before I open a PR that you're not interested in. \r\n"},"comment":{"url":"https://api.github.com/repos/wmlele/devise-otp/issues/comments/141955716","html_url":"https://github.com/wmlele/devise-otp/issues/24#issuecomment-141955716","issue_url":"https://api.github.com/repos/wmlele/devise-otp/issues/24","id":141955716,"user":{"login":"jonathansimmons","id":945202,"avatar_url":"https://avatars.githubusercontent.com/u/945202?v=3","gravatar_id":"","url":"https://api.github.com/users/jonathansimmons","html_url":"https://github.com/jonathansimmons","followers_url":"https://api.github.com/users/jonathansimmons/followers","following_url":"https://api.github.com/users/jonathansimmons/following{/other_user}","gists_url":"https://api.github.com/users/jonathansimmons/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathansimmons/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathansimmons/subscriptions","organizations_url":"https://api.github.com/users/jonathansimmons/orgs","repos_url":"https://api.github.com/users/jonathansimmons/repos","events_url":"https://api.github.com/users/jonathansimmons/events{/privacy}","received_events_url":"https://api.github.com/users/jonathansimmons/received_events","type":"User","site_admin":false},"created_at":"2015-09-21T12:23:56Z","updated_at":"2015-09-21T12:23:56Z","body":"@shimms no I didn't. I have my own implementation in a couple apps but each is different based on that apps needs. \r\n\r\nThat is ultimately exactly why I didn't create something for the gem. I think ever app is going to have different needs. While I don't like the way the gem set it up by default I can't nock that all the necessary info is there for you to build it out on your own. \r\n\r\nSorry I can be of more help. "}}