Amplify-js: MFA for disabling MFA, changing password

[tomquisel]

There seem to be several best practices missing from Cognito's MFA implementation. See Gmail or Github for examples of the below implemented properly.

With Cognito, a user who has TOTP MFA enabled can:

• disable their MFA (assuming MFA is optional on their user pool) without needing to confirm their password or enter an MFA code
• change their password without needing an MFA code
• reset their password without needing an MFA code

In addition, there appears to be no way to download recovery codes that can be used instead of MFA codes in case they lose their TOTP device.

This means that Cognito is both too permissive and too stringent.

A legitimate user who loses their TOTP device has no way to recover their account without admin intervention (which is susceptible to social engineering), as there are no recovery codes. Even resetting their password will not change their MFA status.

Conversely, an attacker who finds a laptop left open and signed in can disable MFA with no credentials, swipe the user's password from their password manager, and change the user's email + password, taking full control of their account without needing the TOTP device.

Are there plans to address those points? Am I missing something?

[ch3ck]

@tomquisel I wonder if there's been any updates on generating the recovery codes for a user account with MFA on Cognito

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically closed because of inactivity. Please open a new issue if are still encountering problems.

[danawoodman]

Bump. This is a huge issue and should be addressed

[filipsuk]

Agreed. Cognito should bring best security practices instead of breaking them :/ But I am afraid it will not be implemented as it would be a breaking change.

[porquelaquiero]

it's been 7 months since filipsuk made last comment. But it doesn't seem like we have solutions for recovery from MFA.. Am I right??

[danawoodman]

Short answer; don't use Cognito if you want a proper security model 😢