WebAuthn and multi factor support

Add two factor support to Pow with at least OTP and FIDO U2F support.

Good primer for ensuring secure and useful two factor setup: https://medium.com/@stuartschechter/before-you-turn-on-two-factor-authentication-27148cc5b9a1

Edit: Here's some security considerations: https://shahmeeramir.com/4-methods-to-bypass-two-factor-authentication-2b0075d9eb5f

---

MFA auth

• WebAuthn
• OTP/TOTP
• Recovery codes
• E-mail/magic link
• Device authorization (in app)

Process

In general the MFA authentication process will go like this:

User ID & password --> MFA authorization --> Signed in

OR as passwordless:

User ID --> MFA authorization --> Signed in

This latter option could also be all on the same page for some of the above methods. The MFA methods can also be used for the registration process.

There should be a controller action for handling 2FA auth, and probably one for handling registration with 2FA. Maybe one for managing 2FA methods.

WebAuthn links

https://webauthn.guide/ https://auth0.com/blog/web-authentication-webauthn-overview-demo-tool/

---

Suggested Ecto schema

There're two ways to go about this. Embedded or separate table. Separate table may make it easier to not require user id, but it could be that the user id should just be set to generated_id if developers wish to login without user id with a randomly generated id that will be stored with the authenticator.

field :type, :string
field :nickname, :string
field :settings, :map

WebAuthn use case

WebAuthn allows for no user id and can be used for single authentication.

The WebAuthn will store at minimum the following data:

{
  credential_id: "credential_id",
  cose_key: "cose_key"
}

For no user id setup, the user id used for the authenticator could be a randomly generated id that's stored in the authenticator schema.

TOTP use case

TOTP can only be used for 2FA. The data stored would be the following:

{
  issuer: "My Service",
  otp_secret: "secret",
  last_otp_at: "492039"
}