Encrypting OTP Secret in the database about otp-jwt

[blafri]

Hay @stas,
Thanks for the great information!!! I will definatly checkout the library you suggeated as i am using PostgreSQL.

[stas]

Thank you @blafri !!!

You're definitely free to use any of the existing solutions to encrypt the secret. Adding the encryption as a built-in functionality, is a bit out of the scope of this project, but the simplicity and the goal of the project is definitely to leave such flexibility up to the end-user.

Personally, if you're on PostgreSQL, I heartily suggest considering:
https://github.com/stas/active_record-pgcrypto

Do you think this would be worthwhile or unnecessary and wont really improve anything.

If you're already encrypting something in the database (which you should as GDPR and such are a thing nowadays :D), then definitely add the OTP stuff in. In the same time, if the backups were leaked, you'd probably reset the secrets for every user the first thing... 🤷

In the same time, the OTP secret doesn't carry any personal information. Knowing this, it is up to you to make the call on what's the best for you and your users here! :)