Implementing two factor authentication / TOTP for CP logins We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like Authy in Craft.

I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to UserSessionService for the actual login. Is there any reason that wouldn't work?

If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?

Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.

PS I know there's the userSession.onBeforeLogin event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)
I know this is a little late, but i've just build a plugin for TOTP. It is in beta, so beware before using it in a production environment.
https://github.com/born05/craft-twofactorauthentication