@Friendica Support @Libranet Support
Dear friends, is there a way, when you activate 2FA, for you to avoid inserting the 2FA code each time you log in through the mobile site?
#Friendica
Dear friends, is there a way, when you activate 2FA, for you to avoid inserting the 2FA code each time you log in through the mobile site?
#Friendica
NorzT likes this.
reshared this
Hypolite Petovan
•Unfortunately no. I have seen the "Remember this device" feature on other websites to avoid inserting the 2FA code each time you log in and I don't like it at all but maybe I should consider it.
I used to believe that this feature made 2FA pretty much useless, but I didn't consider the case where where Friendica is used on the same device as the 2FA app, which makes the requirement to insert the code each time pretty much moot.
It is especially damning since this is my personal use case, and I've been diligently entering my 2FA code multiple times per day without a second thought.
Hypolite Petovan
•It is due to the difference between session timeout and cookie timeout. The 2FA authentication information is stored in a session which expires sooner than the "Remember Me" cookie. Without 2FA the Remember Me cookie transparently refreshes the session when the latter expires but not with 2FA.
The "Remember this device" feature would do the same for 2FA auth as the "Remember Me" feature does for login/password auth, save the authentication information in the long-lasting cookie instead of the short-lived session.
Hypolite Petovan
•like this
Steffen K9 🐰, João Pinheiro and Ermanno like this.
Hypolite Petovan
•Steffen K9 🐰 likes this.
Hypolite Petovan
•Like I said earlier, 2FA doesn’t make sense on the same device where the 2FA app is, and yet so far that’s where the code is systematically required, multiple times per day.
Using the “Remember this device” feature on any other device should be a crime.
João Pinheiro likes this.
Ermanno
•Unless of course someone uses U2F with a physical token:
https://github.com/Yubico/php-u2flib-server
click the button on the key is a lot quicker, and the key can be removed from every device.
Ermanno
•Hypolite Petovan likes this.
Hypolite Petovan
•Ermanno
•It is only for legacy, I prefer to use the U2F token wherever I can. The web app doesn't support yet the U2F but it will, it is recent and still under development. At that point it can be used to secure with a U2F key a website that doesn't support it directly.
Mt daughter broke the screen of my phone a couple of weeks ago and I lost all keys, this can be a problem with reddit for example since there is no way to recover the account ...
The generator app on the phone has serious issues, even google abandoned it, even a web app is probably better if protected properly.
Hypolite Petovan
•Since my own phone screen has been replaced, I'm now using the 2FA plugin of KeePass to store TOTP seeds in my password archive of which I have spread copies on my desktop, my phone and my Nextcloud instance. Should I lose usage of my phone, I can obtain new 2FA codes from KeePass itself or generate QR codes to restore them in any 2FA authenticator app.
My KeePass archive itself is protected with a pass phrase should it fall into ill-intentioned hands.
Ermanno
•Hopefully it will not be abandoned.
Hypolite Petovan
•Hypolite Petovan
•Steffen K9 🐰 likes this.
lostinlight
•