Skip to main content

Unfortunately no. I have seen the "Remember this device" feature on other websites to avoid inserting the 2FA code each time you log in and I don't like it at all but maybe I should consider it.

I used to believe that this feature made 2FA pretty much useless, but I didn't consider the case where where Friendica is used on the same device as the 2FA app, which makes the requirement to insert the code each time pretty much moot.

It is especially damning since this is my personal use case, and I've been diligently entering my 2FA code multiple times per day without a second thought.

It is due to the difference between session timeout and cookie timeout. The 2FA authentication information is stored in a session which expires sooner than the "Remember Me" cookie. Without 2FA the Remember Me cookie transparently refreshes the session when the latter expires but not with 2FA.

The "Remember this device" feature would do the same for 2FA auth as the "Remember Me" feature does for login/password auth, save the authentication information in the long-lasting cookie instead of the short-lived session.

Created an issue I will take take of for the next release: https://github.com/friendica/friendica/issues/9677
I know that, and it's the best answer I can give you. I've slated the work for a remember this device feature.

Like I said earlier, 2FA doesn’t make sense on the same device where the 2FA app is, and yet so far that’s where the code is systematically required, multiple times per day.

Using the “Remember this device” feature on any other device should be a crime.

Unless of course someone uses U2F with a physical token:
https://github.com/Yubico/php-u2flib-server

click the button on the key is a lot quicker, and the key can be removed from every device.

This entry was edited (4 years ago)
BTW for legacy 2FA I use https://github.com/Bubka/2FAuth so I can access the 2FA app everywhere.
This entry was edited (4 years ago)
How do you secure the web app?

It is only for legacy, I prefer to use the U2F token wherever I can. The web app doesn't support yet the U2F but it will, it is recent and still under development. At that point it can be used to secure with a U2F key a website that doesn't support it directly.

Mt daughter broke the screen of my phone a couple of weeks ago and I lost all keys, this can be a problem with reddit for example since there is no way to recover the account ...
The generator app on the phone has serious issues, even google abandoned it, even a web app is probably better if protected properly.

Since my own phone screen has been replaced, I'm now using the 2FA plugin of KeePass to store TOTP seeds in my password archive of which I have spread copies on my desktop, my phone and my Nextcloud instance. Should I lose usage of my phone, I can obtain new 2FA codes from KeePass itself or generate QR codes to restore them in any 2FA authenticator app.

My KeePass archive itself is protected with a pass phrase should it fall into ill-intentioned hands.

I had the same idea but than realized that spreading copies of my 2fa seeds everywhere wasn't really safer than the web app ....
Hopefully it will not be abandoned.
The fact that the password archive itself is encrypted means that I don’t have to solely rely on any of the places I stored it to be safe.
Like I said I haven't find the exact reason of the behavior on mobile only, so it will be a workaround. I may show the checkbox on mobile only because of this.
Sorry. I probably misunderstood the question. I thought it was about each new login, not about users that are already logged in. @hypolite "2FA doesn’t make sense on the same device where the 2FA app is" - very true!