This issue is to implement a 2FA system which uses one-time passwords to authenticate users at logon in addition to their username and password credentials.

The system will:

• Generate a 20 byte secret for each user
• Present this to users in forms which can be used by third-party authenticators:
  1. A QR code which encodes a otpauth:// URI
  2. A base32 encoded string for manual use
• This secret will be used to generate time-based one-time passwords as described in RFC6238, having six digits, a thirty second window, and using the default SHA-1 hash
• Secrets must be stored in encrypted form

In addition, some changes to clients (e.g. HWI) to support this scheme will be required:

• Issue secrets to users on account creation
• Allow secrets to be retrieved and revoked