PieFed Meta

4798 readers

4 users here now

Discuss PieFed project direction, provide feedback, ask questions, suggest improvements, and engage in conversations related to the platform organization, policies, features, and community dynamics.

Wiki

founded 2 years ago

MODERATORS

rimu@piefed.social

[Feature Request] Multi factor authentication (piefed.social)

submitted 5 months ago* (last edited 5 months ago) by Az_1@piefed.social to c/piefed_meta@piefed.social

8 comments fedilink hide all child comments

I'm not sure if this is being worked on or has already been suggested, but this seems to be a feature missing from Piefed. I personally used to use it when I was on Lemmy but haven't been able to on Piefed. I understand if this is difficult to implement but I feel like it would be a good security feature that seems to oddly be missing from Piefed.

top 8 comments

sorted by: hot top controversial new old

[–] rimu@piefed.social 5 points 5 months ago (1 children)

Yes you're not the first to bring this up, so there is a need for it. We have passkeys but Linux support for them is limited and I don't see signs of that improving.

[–] INeedMana@piefed.zip 3 points 5 months ago (1 children)

What about TOTP? Keepass*X supports them

[–] rimu@piefed.social 3 points 5 months ago (2 children)

Yes, that's what I'm thinking of :)

[–] INeedMana@piefed.zip 1 points 5 months ago

Sorry, I don't follow. There are issues with TOTP on Linux?

I thought you meant for example yubikey, where I could see the problem in the fact that it requires additional binary and maybe not every distro has it

But TOTP?

[–] erebion@news.erebion.eu 1 points 5 months ago (1 children)

TOTP requires a 2nd device to be a 2nd factor, whereas many people want to use their phone with passwords synced.

Also, mabnually typing in numbers sucks.

That's where WebAuthn comes in. Users couls, for example jus log in with a Nitrokey or Yubikey.

[–] INeedMana@piefed.zip 2 points 5 months ago (1 children)

TOTP requires a 2nd device to be a 2nd factor, whereas many people want to use their phone with passwords synced.

You can store the secret on the same device as password and it'll still protect you from eavesdropped, leaked or guessed password

[–] erebion@news.erebion.eu 2 points 5 months ago (1 children)

It's not a 2nd factor if there's only one place knowledge has to bde stolen from you.

[–] INeedMana@piefed.zip 1 points 5 months ago

That depends on the security vector one tries to secure. If my password manager DB gets stolen and password gets hacked - sure. But that is not the only threat one might want to use TOTP against. Even if my TOTP is on the same device as password, if someone manages to recreate my password or eavesdrops it or my password (but not TOTP secret) leaks, TOTP still guards my account