Add support for Passkeys

[maxpatiiuk]

Passkeys are the industry standard replacement to passwords and 2fa, which is far more secure and far more convenient

[grantfitzsimmons]

Read more on the discussion between Mark Pitblado and Héryk Julien on the Speciforum:

Perhaps the highest marginal add that would solve most (though not all) of the objectives, would be the integration of TOTP on the Specify login (passkeys, another alternative, were opened for suggestion here). This provides a couple of benefits that address your points, while also being easier to implement. TOTP is almost always done at the application level, so it is a better fit, while not interfering with rate limiting or DDoS that is done at the network level. There are django packages that are designed for this purpose, as it is a common feature to implement.

This could be enabled on all deployments by default as it would ship with the source code, raising the baseline security standard by quite a bit. There would be no integration or things to configure for an IT team, it would work out of the box.

If Specify was to implement rate limiting, perhaps it's better that we think about it not from the traditional sense (limiting requests as they come into the web server), but setting a maximum amount of incorrect guesses that can be made before the user is locked out, requiring the admin to click a button in the. security and accounts menu to reset the counter. This could be done for either the user/login, TOTP, or both. Of everything in this discussion, a failed login counter on the current login is probably the easiest to implement.

One downside to this approach, is that I can now deny someone access to their account pretty easily, all I need to do is head to the instance, and fail the login attempts a few times and they won't be able to login. Thus, I would suggest it be done at the TOTP layer if done at all.

Most attackers these days will use phishing rather than trying to brute force a login page, because a brute force is noisy and most servers will have some method in place to automatically reject it and then ban the IP (or at least, put it on a timeout).