Show gem owners that are not using MFA when logged in as owner

[lmansur]

As a response to recent gem exploits, we are seeing an increased desire to ensure all gem owners are using MFA.

This PR adds a way for gem owners to check if their fellow owners are using MFA. Regular users can't see this.

The following gif shows the behavior when logged in as an owner and MFA is not enabled for everyone:

The following screenshot shows the behavior when logged in as an owner and MFA is enabled for everyone:

[eliotsykes]

Good enhancement 👍

[lmansur]

Thank you for your review, @eliotsykes .

Let me know what you think of the changes.

[geemus]

Looks good to me, thanks for taking this on!

[eliotsykes]

Thanks for building this @lmansur. The changes look good.

---

IIRC, currently any gem owner can silently and without confirmation add another user as an owner.

If this is still true, what risks are there, if any, of the feature in this PR being abused?

One risk might be a malicious owner could add another user as an owner to determine their MFA settings. Is this a problem?

[lmansur]

I think it can be exploited.

However, I also think the benefit of having a way to ensure all owners are using MFA outweighs this risk.

I would love some more input into this matter.

[geemus]

It may be that being able to add people without confirmation is more a bug/coincidence than a feature, but that also seems way out of scope for this particular change.

Is there additional danger associated with knowing that someone doesn't have MFA? You would still need their password, and if you already had their password you would already be able to find out if they had MFA by attempting to use it. Given that, I'm not sure we are any worse off, but I know my security-mindedness is not the strongest. Please let me know if there is a case I'm not thinking about.

[lmansur]

I think it's more a case of specifically targeting owners that don't have MFA and not wasting time with those that do.

It's not ideal, but I wouldn't call that a blocker.

[lmansur]

Anything we can do to move this forward?

[bronzdoc]

@lmansur Thanks for the PR!

This seems like a nice feature It will help create awareness around not using MFA.

[lmansur]

@bronzdoc I appreciate you taking the time to review this!

[mensfeld]

@geemus I believe it should also include the code for the data dumps export. This info is super valuabvle for probabilistic exploit analysis (cc @colby-swandale @dwradcliffe)

[indirect]

Thanks, this seems like a solid improvement!

[geemus]

Thanks!

[lmansur]

Thanks, everyone! 🎉