Improve account security with a second factor #1868

Closed
opened 2020-06-13 20:55:34 +00:00 by Duponin · 3 comments
Member

Pleroma accounts can't be hardened with a second factor.

To support fido2 would be a great move, it's the only second factor that is proof to MITM.
TOTP is good alternative without dedicated security hardware.

Once second factor is activated, a factor can only be added or removed with a second factor validation. Example:

1. add TOTP factor
2. confirm with TOTP
3. add FIDO2 factor
4. remove TOTP factor
5. confirm action with FIDO

The only trap to avoid is to be unable to add or remove a factor because there's only one and it's lost.

Pleroma accounts can't be hardened with a second factor. To support `fido2` would be a great move, it's the only second factor that is proof to MITM. `TOTP` is good alternative without dedicated security hardware. Once second factor is activated, a factor can only be added or removed with a second factor validation. Example: ``` 1. add TOTP factor 2. confirm with TOTP 3. add FIDO2 factor 4. remove TOTP factor 5. confirm action with FIDO ``` The only trap to avoid is to be unable to add or remove a factor because there's only one and it's lost.
Member

Pleroma accounts can't be hardened with a second factor.

but they can? See #4187

> Pleroma accounts can't be hardened with a second factor. but they can? See #4187
Author
Member

I didn't find it after a few searches, my bad.

It's not available in 2.0.7. Tried to read git history but I can't read if develop has been merged in stable for 2.0.7
image

I didn't find it after a few searches, my bad. It's not available in `2.0.7`. Tried to read git history but I can't read if `develop` has been merged in `stable` for `2.0.7` ![image](/attachments/065e06bd-602d-40ce-8ebc-5935e8e7934d)
114 KiB

Screenshot_2020-06-15_lain_com

It will be in the next release

![Screenshot_2020-06-15_lain_com](/attachments/7d404be3-ad12-40a1-aff3-f3d66cf65611) It will be in the next release
Sign in to join this conversation.
No milestone
No project
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma#1868
No description provided.