OTP (whether you also use a password or not) is going to be crucial in the future in applications that are accessible to everyone over the internet. It is becoming harder to sell these applications when they lack MFA (or at least something better than just a password). So I hope there will be a built-in solution for this in the future.
We have a proof of concept that uses AwareIM standard password functionality combined with 6 digit OTP such as Google Authenticator or Authy.
It is still a bit buggy.
Node.js runs on the same server to handle the OTP, and we do use the guest VP for typing the OTP.
We have not tried it without a user password.
Could in theory be combined with the SMS functionality. But that is also less secure than a phone app.
From a security standpoint, I wonder if it is best practice to let the users reach the guest VP at all?
I would prefer if the password and OTP was typed at the login page, but it seems way harder to build it that way.
I mean, if you are at the guest VP, you are sort of authenticated, and perhaps able to try some malicious URL commands that wouldn't be possible at the standard login page? For instance, there was a bug way back where you could access, I think it was either the guest VP or the forgotten password function, then click "back" in the browser, and voila, you were logged in to one of the main VPs.
Just some spontaneous thoughts.
