Mailcow-dockerized: Enable multiple 2FA

Created on 8 Jan 2019 · 13Comments · Source: mailcow/mailcow-dockerized

Is your feature request related to a problem? Please describe.

Currently only one 2FA mode can be selected. Either TOTP, U2F or Yubico 2FA

Describe the solution you'd like

It would be nice to enable e.g. U2F _and_ TOTP. I don't think this would compromise the security in any way.

enhancement

Source

vbrandl

👍12

Most helpful comment

It does not violate anything. I talked to Yubi when we implemented it and they even sponsored some keys for a giveaway.

You can add multple keys without a problem, you just cannot mix with TOTP etc. - it is NO violation of anything to not being able to mix u2f with totp etc.

That's ridiculous, sorry. I don't know if that was just written to put pressure on us to work on something you want. :(

andryyy on 31 Jan 2020

👍5

All 13 comments

Multiple TOTPs don't work either.

735

vain90 on 12 Feb 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

stale[bot] on 13 Apr 2019

What's your opinion on this, @andryyy

phenomax on 13 Aug 2019

I think that would be a nice improvement, specially being able to use 2x U2F sticks (e.g. one for a fallback). However I think it doesn't have that kind of high priority, and also might require quite a lot of work to rework the current code.

patschi on 13 Aug 2019

Well you could create another Admin account and use a different key/totp

Braintelligence on 13 Aug 2019

@Braintelligence This would be a quite ugly workaround, but no solution.

phenomax on 13 Aug 2019

Definitely interested in this feature too.

gromain on 16 Oct 2019

it's not a nice to have and in my optionion not a feature request, but a bug(wrong implementation), only being able to to add one u2f key violates the authentication standard or at lest best practice.
Cause it's not possible to make backups of yubikey etc... it's a absolute must have.

HuntStarJonny on 31 Jan 2020

👎2

It does not violate anything. I talked to Yubi when we implemented it and they even sponsored some keys for a giveaway.

You can add multple keys without a problem, you just cannot mix with TOTP etc. - it is NO violation of anything to not being able to mix u2f with totp etc.

That's ridiculous, sorry. I don't know if that was just written to put pressure on us to work on something you want. :(

andryyy on 31 Jan 2020

👍5

well then my bad, i didn't test it correct with 2 different yubikey, works fine - sorry

HuntStarJonny on 31 Jan 2020

Adding a second TOTP device is still a great idea
It would make administration much more handy if you have a password vault with TOTP feature and also will be able to get a TOTP on mobile if you are on the go.