You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

229 lines
12 KiB

Add WebAuthn as an alternative 2FA method (#14466) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
4 years ago
Add WebAuthn as an alternative 2FA method (#14466) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
4 years ago
  1. ---
  2. en:
  3. simple_form:
  4. hints:
  5. account_alias:
  6. acct: Specify the username@domain of the account you want to move from
  7. account_migration:
  8. acct: Specify the username@domain of the account you want to move to
  9. account_warning_preset:
  10. text: You can use post syntax, such as URLs, hashtags and mentions
  11. title: Optional. Not visible to the recipient
  12. admin_account_action:
  13. include_statuses: The user will see which posts have caused the moderation action or warning
  14. send_email_notification: The user will receive an explanation of what happened with their account
  15. text_html: Optional. You can use post syntax. You can <a href="%{path}">add warning presets</a> to save time
  16. type_html: Choose what to do with <strong>%{acct}</strong>
  17. types:
  18. disable: Prevent the user from using their account, but do not delete or hide their contents.
  19. none: Use this to send a warning to the user, without triggering any other action.
  20. sensitive: Force all this user's media attachments to be flagged as sensitive.
  21. silence: Prevent the user from being able to post with public visibility, hide their posts and notifications from people not following them.
  22. suspend: Prevent any interaction from or to this account and delete its contents. Revertible within 30 days.
  23. warning_preset_id: Optional. You can still add custom text to end of the preset
  24. announcement:
  25. all_day: When checked, only the dates of the time range will be displayed
  26. ends_at: Optional. Announcement will be automatically unpublished at this time
  27. scheduled_at: Leave blank to publish the announcement immediately
  28. starts_at: Optional. In case your announcement is bound to a specific time range
  29. text: You can use post syntax. Please be mindful of the space the announcement will take up on the user's screen
  30. appeal:
  31. text: You can only appeal a strike once
  32. defaults:
  33. autofollow: People who sign up through the invite will automatically follow you
  34. avatar: PNG, GIF or JPG. At most %{size}. Will be downscaled to %{dimensions}px
  35. bot: Signal to others that the account mainly performs automated actions and might not be monitored
  36. context: One or multiple contexts where the filter should apply
  37. current_password: For security purposes please enter the password of the current account
  38. current_username: To confirm, please enter the username of the current account
  39. digest: Only sent after a long period of inactivity and only if you have received any personal messages in your absence
  40. discoverable: Allow your account to be discovered by strangers through recommendations, profile directory and other features
  41. discoverable_no_directory: Allow your account to be discovered by strangers through recommendations and other features
  42. email: You will be sent a confirmation e-mail
  43. fields: You can have up to 4 items displayed as a table on your profile
  44. header: PNG, GIF or JPG. At most %{size}. Will be downscaled to %{dimensions}px
  45. inbox_url: Copy the URL from the frontpage of the relay you want to use
  46. irreversible: Filtered posts will disappear irreversibly, even if filter is later removed
  47. locale: The language of the user interface, e-mails and push notifications
  48. locked: Manually control who can follow you by approving follow requests
  49. password: Use at least 8 characters
  50. phrase: Will be matched regardless of casing in text or content warning of a post
  51. scopes: Which APIs the application will be allowed to access. If you select a top-level scope, you don't need to select individual ones.
  52. setting_aggregate_reblogs: Do not show new boosts for posts that have been recently boosted (only affects newly-received boosts)
  53. setting_default_sensitive: Sensitive media is hidden by default and can be revealed with a click
  54. setting_display_media_default: Hide media marked as sensitive
  55. setting_display_media_hide_all: Always hide media
  56. setting_display_media_show_all: Always show media
  57. setting_hide_network: Who you follow and who follows you will be hidden on your profile
  58. setting_noindex: Affects your public profile and post pages
  59. setting_show_application: The application you use to post will be displayed in the detailed view of your posts
  60. setting_use_blurhash: Gradients are based on the colors of the hidden visuals but obfuscate any details
  61. setting_use_pending_items: Hide timeline updates behind a click instead of automatically scrolling the feed
  62. username: Your username will be unique on %{domain}
  63. whole_word: When the keyword or phrase is alphanumeric only, it will only be applied if it matches the whole word
  64. domain_allow:
  65. domain: This domain will be able to fetch data from this server and incoming data from it will be processed and stored
  66. email_domain_block:
  67. domain: This can be the domain name that shows up in the e-mail address, the MX record that domain resolves to, or IP of the server that MX record resolves to. Those will be checked upon user sign-up and the sign-up will be rejected.
  68. with_dns_records: An attempt to resolve the given domain's DNS records will be made and the results will also be blocked
  69. featured_tag:
  70. name: 'You might want to use one of these:'
  71. form_challenge:
  72. current_password: You are entering a secure area
  73. imports:
  74. data: CSV file exported from another Mastodon server
  75. invite_request:
  76. text: This will help us review your application
  77. ip_block:
  78. comment: Optional. Remember why you added this rule.
  79. expires_in: IP addresses are a finite resource, they are sometimes shared and often change hands. For this reason, indefinite IP blocks are not recommended.
  80. ip: Enter an IPv4 or IPv6 address. You can block entire ranges using the CIDR syntax. Be careful not to lock yourself out!
  81. severities:
  82. no_access: Block access to all resources
  83. sign_up_requires_approval: New sign-ups will require your approval
  84. severity: Choose what will happen with requests from this IP
  85. rule:
  86. text: Describe a rule or requirement for users on this server. Try to keep it short and simple
  87. sessions:
  88. otp: 'Enter the two-factor code generated by your phone app or use one of your recovery codes:'
  89. webauthn: If it's an USB key be sure to insert it and, if necessary, tap it.
  90. tag:
  91. name: You can only change the casing of the letters, for example, to make it more readable
  92. user:
  93. chosen_languages: When checked, only posts in selected languages will be displayed in public timelines
  94. labels:
  95. account:
  96. fields:
  97. name: Label
  98. value: Content
  99. account_alias:
  100. acct: Handle of the old account
  101. account_migration:
  102. acct: Handle of the new account
  103. account_warning_preset:
  104. text: Preset text
  105. title: Title
  106. admin_account_action:
  107. include_statuses: Include reported posts in the e-mail
  108. send_email_notification: Notify the user per e-mail
  109. text: Custom warning
  110. type: Action
  111. types:
  112. disable: Freeze
  113. none: Send a warning
  114. sensitive: Sensitive
  115. silence: Limit
  116. suspend: Suspend
  117. warning_preset_id: Use a warning preset
  118. announcement:
  119. all_day: All-day event
  120. ends_at: End of event
  121. scheduled_at: Schedule publication
  122. starts_at: Start of event
  123. text: Announcement
  124. appeal:
  125. text: Explain why this decision should be reversed
  126. defaults:
  127. autofollow: Invite to follow your account
  128. avatar: Avatar
  129. bot: This is a bot account
  130. chosen_languages: Filter languages
  131. confirm_new_password: Confirm new password
  132. confirm_password: Confirm password
  133. context: Filter contexts
  134. current_password: Current password
  135. data: Data
  136. discoverable: Suggest account to others
  137. display_name: Display name
  138. email: E-mail address
  139. expires_in: Expire after
  140. fields: Profile metadata
  141. header: Header
  142. honeypot: "%{label} (do not fill in)"
  143. inbox_url: URL of the relay inbox
  144. irreversible: Drop instead of hide
  145. locale: Interface language
  146. locked: Require follow requests
  147. max_uses: Max number of uses
  148. new_password: New password
  149. note: Bio
  150. otp_attempt: Two-factor code
  151. password: Password
  152. phrase: Keyword or phrase
  153. setting_advanced_layout: Enable advanced web interface
  154. setting_aggregate_reblogs: Group boosts in timelines
  155. setting_auto_play_gif: Auto-play animated GIFs
  156. setting_boost_modal: Show confirmation dialog before boosting
  157. setting_crop_images: Crop images in non-expanded posts to 16x9
  158. setting_default_language: Posting language
  159. setting_default_privacy: Posting privacy
  160. setting_default_sensitive: Always mark media as sensitive
  161. setting_delete_modal: Show confirmation dialog before deleting a post
  162. setting_disable_swiping: Disable swiping motions
  163. setting_display_media: Media display
  164. setting_display_media_default: Default
  165. setting_display_media_hide_all: Hide all
  166. setting_display_media_show_all: Show all
  167. setting_expand_spoilers: Always expand posts marked with content warnings
  168. setting_hide_network: Hide your social graph
  169. setting_noindex: Opt-out of search engine indexing
  170. setting_reduce_motion: Reduce motion in animations
  171. setting_show_application: Disclose application used to send posts
  172. setting_system_font_ui: Use system's default font
  173. setting_theme: Site theme
  174. setting_trends: Show today's trends
  175. setting_unfollow_modal: Show confirmation dialog before unfollowing someone
  176. setting_use_blurhash: Show colorful gradients for hidden media
  177. setting_use_pending_items: Slow mode
  178. severity: Severity
  179. sign_in_token_attempt: Security code
  180. type: Import type
  181. username: Username
  182. username_or_email: Username or Email
  183. whole_word: Whole word
  184. email_domain_block:
  185. with_dns_records: Include MX records and IPs of the domain
  186. featured_tag:
  187. name: Hashtag
  188. interactions:
  189. must_be_follower: Block notifications from non-followers
  190. must_be_following: Block notifications from people you don't follow
  191. must_be_following_dm: Block direct messages from people you don't follow
  192. invite:
  193. comment: Comment
  194. invite_request:
  195. text: Why do you want to join?
  196. ip_block:
  197. comment: Comment
  198. ip: IP
  199. severities:
  200. no_access: Block access
  201. sign_up_requires_approval: Limit sign-ups
  202. severity: Rule
  203. notification_emails:
  204. appeal: Someone appeals a moderator decision
  205. digest: Send digest e-mails
  206. favourite: Someone favourited your post
  207. follow: Someone followed you
  208. follow_request: Someone requested to follow you
  209. mention: Someone mentioned you
  210. pending_account: New account needs review
  211. reblog: Someone boosted your post
  212. report: New report is submitted
  213. trending_tag: New trend requires review
  214. rule:
  215. text: Rule
  216. tag:
  217. listable: Allow this hashtag to appear in searches and suggestions
  218. name: Hashtag
  219. trendable: Allow this hashtag to appear under trends
  220. usable: Allow posts to use this hashtag
  221. 'no': 'No'
  222. recommended: Recommended
  223. required:
  224. mark: "*"
  225. text: required
  226. title:
  227. sessions:
  228. webauthn: Use one of your security keys to sign in
  229. 'yes': 'Yes'