=== RapID Secure Login === Contributors: intercede01 Tags: 2FA, security, login, authentication, fingerprint, Secure, logon, 2 factor authentication Requires at least: 4.5 Tested up to: 4.7 Stable tag: 2.0.2 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html RapID is a Clef alternative that lets you securely login to WordPress using your phone with a fingerprint or PIN. == Description == RapID Secure Login (RapID-SL) is a WordPress Plugin that works with an Android or iOS app to let you and your subscribers login to websites and blogs without passwords. Using the RapID credentialing service, you get high security authentication using 2048-bit cryptographic keys without having to write a line of code. To login from any desktop browser, simply scan the QR-code with RapID-SL on your phone, and it delivers a cryptographic signature to log you in without having to enter any of your details into the browser. That means there's no risk of your details being intercepted, cached in the browser or key-logged and you don't have to remember horrifically complex passwords for every site you visit. RapID-SL is a great alternative to Clef, with the added benefit of not relying on an external authentication service after enrolment. You can also use RapID-SL directly from your phone - simply navigate to the site on your phone's browser as usual, then tap the QR-code when it pops up, and it launches RapID-SL automatically for you. You just confirm with your finger or PIN. The RapID-SL app manages all of your accounts, so you can login to multiple accounts on multiple websites using just your phone with your finger or a simple PIN. When you go to login to a site on which you have multiple accounts, RapID-SL just asks you which account you want to use. Your WordPress site tracks the most recent authentication for each phone and subscribers or administrators can have more than one phone for their accounts. On the phone, RapID-SL keeps a track of your login history for you. To add RapID login to your existing WordPress profile, simply go to "Edit My Profile", scroll down to the RapID section and click on the logo to request a new credential. Scan the code with the app on your phone and RapID just does the rest. As a bonus, the app also lets you set up your own details - name, email address and a meaningful name for your phone or tablet. If "Anyone can register" is enabled in WordPress, a subscriber can scan a QR code on the Register screen to automatically create an account and associate it with a new credential. The account still has to be confirmed by responding to the WordPress activation email (for obvious security reasons), but you can then logon to the site without ever having had to worry about passwords. == Installation == As the site administrator: 1. Upload the plugin files to the `/wp-content/plugins/rapid-secure-login` directory, or install the plugin through the WordPress plugins screen directly. 1. Install the RapID Secure Login app on your phone. 1. Scan the QR Code in the RapID Secure Login Word Press Plugin Settings Page using the RapID Secure Login mobile App 1. The App will guide you through the RapID sign up process to create an account. Once registered, your RapID certificates will be uploaded automatically to this Wordpress site and "Site Configured" will appear beneath the RapID logo. Your site is now enabled for RapID Secure Login. As an administrator or a subscriber you may now: 1. Logon as usual and view your WordPress User Profile (Users->Your Profile) and scroll down to the RapID section. 1. Click on the RapID logo to request a logon for your phone. Wait until a RapID QR code is shown. 1. Scan this code with the RapID-SL app on your phone and follow the instructions. Next time you want to log in, just scan the QR code with your phone. == Frequently Asked Questions == = Can I login to more than one account for each site? = Yes - when RapID-SL sees that you have more than one credential on your phone for the site, it lets you choose the one you want. = What happens if I lose or change my phone? = At present, it is important that you keep a record of your original password, or that you are able to request an administrator reset from the sites you register with. You can also have the app on more than one phone of course! Then you can login again and re-register with your new phone. We do intend to introduce a secure, managed recovery service in the near future to make this even simpler. = Can I still login if the RapID service goes down? = Yes - the RapID Service is only used for creating you user credentials when you enrol. At the point of authentication, all messages are purely between the app and the WordPress site. = Can I un-authorize a phone from my accounts? = Yes - just login to your account, edit your WordPress profile and you can remove enrolled phones from your account. The site administrator can also do this on your behalf. = Does RapID know my passwords or user ID? = No - RapID works independently of your passwords and user ID. You can change those and lock them away off-line! When you create a RapID credential for your phone, the plugin internally generates a random unique identifier, which it associates with your WordPress ID. This random ID is the only WordPress account information the RapID app or service needs. Your actual ID and password are never sent outside your WordPress site. = What does the service cost? = RapID accounts are given a certain number of free licences to get you started. Additional licenses can be purchased through the [RapID web site](https://rapidportal.intercede.com). = Where can I get technical assistance? = The [RapID-SL Web site and Support Forum](https://forums.intercede.com) helps you to find answers to technical questions and lets site administrators post enquiries and comments. == Screenshots == 1. RapID-SL displays a QR code in the WordPress login page for you to scan with the phone app 1. You can use a shortcode to include RapID-SL in other templates and pages 1. The display of existing username password fields can be managed by a switch in Settings 1. Users can add and remove their phones from the list of authenticators in their profile page. RapID reports when they were last used. You can add another phone by clicking on the RapID logo. 1. When the registration QR code is shown, just scan it with the app to add your phone. 1. The app is simple to use - just click to scan 1. The app can manage multiple accounts on multiple websites, each with their own anonymized credentials 1. The app maintains a log of your activity == Changelog == = 2.0.2 = * Improved upgrade path to not remove files before upgrade. * Improved error handling for ajax pollers. = 2.0.1 = * Updated information on plugin settings page. * Updated readme.txt. * Minor bug fixes for front end registration and browser compatibility. = 2.0.0 = * Ajax entry points naming standardized * Migrate to JSON Ajax data throughout * File-based polling check to avoid full stack load = 1.1.9 = * More efficient Ajax polling mechanism. * Improved error messages. = 1.0.3 = * Added the ability to securely add users from an externally trusted source. = 1.0.2 = * Security fix for trusted root certificate validation. = 1.0.1 = * First release. = 1.0.0 = * First beta test version. == Upgrade Notice == = 1.0.2 = This version includes an important security fix. Please upgrade immediately. == Service Platform Requirements == Your site must have correctly configured support for OpenSSL. Please check with your hosting service provider if you are unsure. If OpenSSL is not configured correctly, you will get an error message when you try to upload your RapID service key from the settings screen. If your WordPress site uses self signed certificates to support https (during local development for example), it will not be possible to configure the site correctly, as the plugin will not be able to trust the endpoint where the certificates will be uploaded. The solution would be to use a properly trusted certificate from a recognised certificate authority. If your website uses a "privacy mode" or basic authentication to protect the WordPress administration area in addition to the normal WordPress login mechanism, it will not be possible for the plugin to configure the site correctly. The "privacy mode" or basic authentication will need to be turned off.