{"action":"created","issue":{"url":"https://api.github.com/repos/ClaudeBot/hubot-rbac/issues/5","labels_url":"https://api.github.com/repos/ClaudeBot/hubot-rbac/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/ClaudeBot/hubot-rbac/issues/5/comments","events_url":"https://api.github.com/repos/ClaudeBot/hubot-rbac/issues/5/events","html_url":"https://github.com/ClaudeBot/hubot-rbac/issues/5","id":119281114,"number":5,"title":"[Feature Request] two faktor authentication","user":{"login":"Jaglag","id":6708499,"avatar_url":"https://avatars.githubusercontent.com/u/6708499?v=3","gravatar_id":"","url":"https://api.github.com/users/Jaglag","html_url":"https://github.com/Jaglag","followers_url":"https://api.github.com/users/Jaglag/followers","following_url":"https://api.github.com/users/Jaglag/following{/other_user}","gists_url":"https://api.github.com/users/Jaglag/gists{/gist_id}","starred_url":"https://api.github.com/users/Jaglag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jaglag/subscriptions","organizations_url":"https://api.github.com/users/Jaglag/orgs","repos_url":"https://api.github.com/users/Jaglag/repos","events_url":"https://api.github.com/users/Jaglag/events{/privacy}","received_events_url":"https://api.github.com/users/Jaglag/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ClaudeBot/hubot-rbac/labels/under%20consideration","name":"under consideration","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-28T08:55:50Z","updated_at":"2015-11-30T16:13:32Z","closed_at":null,"body":"Hi Mrsaints,\r\n for example i set Super user to Jaglag and my nick is xxxblablaxxx then i reconnect with Jaglag while the \"original\" Jaglag is offline then i get every right of a super user.\r\nI think a good way is to set a passwort via Private message and ask the \"user\" here Jaglag for the passwort in Query.\r\n\r\n### example for first auth:\r\nhubot auth me\r\nHello Jaglag you didnt set a Super User Password yet please Private message me your desired Passwort.\r\n\r\n\r\n(query/private message window)\r\n\r\nexamplepass123\r\nThank you Jaglag your Super User Password \"examplepass123\" is set and will be encryptet in my brain now.\r\nYour Status/rank is now Super User!\r\n\r\n\r\n### example for re auth:\r\nhubot auth me\r\nhe should respond (if he see that i normally an power user)\r\nPlease provide me your Secret pass in Query otherwise you Status change to \"lowest Rank here\" in 60 seconds\r\n\r\n(query/private message window)\r\n\r\nexamplepass123\r\nThank you and Welcome back Jaglag you are now Identified as an Super user!\r\n\r\nWhile these 60 seconds who the user not authed via the hubot he shouldnt be able to send any command except the pass to hubot so that there´s no abuse in that 60 seconds.\r\n\r\nI think the secret pass shouldnt be set via an seperate hubot variable cause its Plain and everyone can see that who have access to the server.\r\nIt should maybe encryptet in hubot brain or something.\r\n\r\nevery other way do identify an user isnt secure or possible cause every adapter handle user recognition different so this method is the only good working for every adapter i think.\r\n\r\nHuge feature request i know but it´s security ;p"},"comment":{"url":"https://api.github.com/repos/ClaudeBot/hubot-rbac/issues/comments/160674528","html_url":"https://github.com/ClaudeBot/hubot-rbac/issues/5#issuecomment-160674528","issue_url":"https://api.github.com/repos/ClaudeBot/hubot-rbac/issues/5","id":160674528,"user":{"login":"Jaglag","id":6708499,"avatar_url":"https://avatars.githubusercontent.com/u/6708499?v=3","gravatar_id":"","url":"https://api.github.com/users/Jaglag","html_url":"https://github.com/Jaglag","followers_url":"https://api.github.com/users/Jaglag/followers","following_url":"https://api.github.com/users/Jaglag/following{/other_user}","gists_url":"https://api.github.com/users/Jaglag/gists{/gist_id}","starred_url":"https://api.github.com/users/Jaglag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jaglag/subscriptions","organizations_url":"https://api.github.com/users/Jaglag/orgs","repos_url":"https://api.github.com/users/Jaglag/repos","events_url":"https://api.github.com/users/Jaglag/events{/privacy}","received_events_url":"https://api.github.com/users/Jaglag/received_events","type":"User","site_admin":false},"created_at":"2015-11-30T16:13:32Z","updated_at":"2015-11-30T16:13:32Z","body":"Yea you right forget that you have to login via pw and id on xmpp or other stuff XD"}}