authy | Go library and program to access your Authy TOTP secrets | Authentication library

If you just want to access user using email, you're not using authentication on the first place. So, to solve your purpose, following approaches can be followed:

• Get user email in url params in every request (so that user can be identified)
• Set default password while creating the user account for all users and use that password while authentication (not recommended)

There was a comma after the phone initialization which was causing a type conversion to a tuple (for testing i just took the important parts of your code and it worked for me)

Twilio developer evangelist here.

1. You will need to write a script to register your users. When you have registered a user, you will receive an authy_id for the user, which you will need to store with your user record.

2. If a user updates their phone number then you should update the Authy user. To do so, you will want to delete the old user and re-register with the new phone number. You will then receive a new authy_id and you should re-confirm the user can authenticate by challenging them for a new code before you complete the update. If the user updates their email then you can do the same process of deleting and creating a new user though you should receive the same authy_id back if the phone number hasn't changed (though this will add the email address to Authy's representation of the user).

3. Check the documentation on PSD2 compliant authentication with Authy here. If you are sending SMS messages, then you should set the action and action_message parameters, which tie the message to the authentication. For the app based authentications you can do it via Push Notifications (in which you can include transaction details in the push). If you don't want to implement push, then you do need to get your user to scan a QR code in order to tie the transaction to the authentication (the regular code generated by the app is not connected to a transaction, so is ineligible for PSD2 authentication).

Let me know if this helps at all.

I found the problem. Session saving is written in StartSession middleware and will kick in only on each request. In this case, we are not redirecting after $request->session()->regenerate();, rather we are calling the ->authenticated() method.

The session is not saved due to the middleware not being triggered yet, hence the inconsistency in session id. User's session count is also inconsistent due to this, since the latest session is not yet saved, the count will always be returned as actualCount - 1.

A workaround to this is to override ->sendLoginResponse($request) method and manually save the session after regeneration like so:

Internally, these 2FA generators usually work based on a time-based one-time password algorithm. Those algorithms work by using strong hash functions on a combination of two values: a shared secret and the current time increment, and specifically use a construction called HMAC that’s known to be secure provided the underlying hash function is.

As a result, if someone could predict future outputs of your 2FA device by seeing some timestamps and outputs from the 2FA device, then they would either (1) have to know the shared secret or (2) be able to break the HMAC. Both of these are unlikely unless someone either has hacked Google or knows of attacks on HMAC or the underlying hash function in ways beyond what’s in the public literature.

In other words, you shouldn’t need to worry about someone guessing future values given past values, though I’d still advise against giving out old values because you shouldn’t be giving out 2FA values to anyone except the site you’re logging into. :-)

Twilio developer evangelist here.

Each different application/method of OTP delivery with Authy is assigned a different secret and generates different codes. So you cannot send the same code over email and SMS at the same time.

However, if you send two different OTP codes to your user, then either of them will work when they input the code and you verify it against the API.

Please use after_commit instead of after_save. This way, the user record is surely committed in the database

There are two additional callbacks that are triggered by the completion of a database transaction: after_commit and after_rollback. These callbacks are very similar to the after_save callback except that they don't execute until after database changes have either been committed or rolled back.

https://guides.rubyonrails.org/active_record_callbacks.html#transaction-callbacks

Actually it's not relevant to your question, you can use either.

Here's how I would approach your use case: You want to get notified when an user is created:

Twilio Verify supports this (along with Voice, SMS, and Email channels).

Custom Verification Codes

Authy adds support for user authentication via email https://www.twilio.com/changelog/authy-adds-support-user-authentication-email