Two-step login process - Is it possible?

Question

Is it possible to do the following with Wordpress (without hacking too much code - I would like to make this a general plugin using simple hooks)?

1. Log in with the username/password.
2. If username/password correct then have another authentication step (a token or a question).
3. If token is also correct, then give user access.

For those of you that have bank accounts with Bank of America, this is very similar to their "sitekey" login system. If anyone has any tips or plugin examples, don't hesitate to link them. Thank you!

This is virtually identical to the following question: http://wordpress.org/support/topic/two-step-authentication-login-needed on the official forums.

Answer 1

If you want a really neat and free method of doing this, this is a cool plugin. Essentially, it implements the Google Authenticator code for a WordPress site.

http://wordpress.org/extend/plugins/google-authenticator/

Google Authenticator is a free app available for the iPhone, Android, or Blackberry phones. It implements a 2-step verification system with 30 second expiring codes, just like many of those little fob systems you've probably used (RSA is well known for these).

The difference is that GA uses an open sourced algorithm. They made the apps available so they could implement it in GMail, but because the algorithm is known, anybody can use it and have the apps work for them too.

The sync process is kinda cool too. Basically it shows you a QR code which you scan with the app and voila, it's synced.

The plugin implements an extra field on the Login page for the authentication token code instead of having it as a separate step, but the security here is basically the same. Without the password and the device that generates the token, you can't log in.

Answer 2

I guess this plugin could help you:

http://wordpress.org/extend/plugins/2stepauth-for-wordpress/

It implements 2nd step of Authentication using one of: - SMS Verification - Backup Codes - Email Verification

It is very similar to Gmail's 2-step authentication.

The plugin comes into role after the user enters correct login credentials. The plugin redirects user to 2nd Authentication page where the user has to authenticate himself using one of the above 3 methods. Once 2nd step is completed, the user can access his Dashboard.

Answer 3

You can use wp_redirect(). Don't forget to exit; after that. Else you'd loop endlessly.