support of two factor authentication?

[Tom Fowle]

As more isps and email providers require two factor authentication, I hope
mutt will support this security system!

tom Fowle WA6IVG

[José María Mateos]

Post by Tom Fowle
As more isps and email providers require two factor authentication, I
hope mutt will support this security system!

Doesn't mutt already "support" this? I use Fastmail with 2FA enabled.
What I do then is to generate an app-specific password which is the one
I use in the mutt configuration. There's not much to support, it's just
a different password, unless there's something I'm not getting right.

Cheers,

[Ben Oliver]

Post by José María Mateos

Post by Tom Fowle
As more isps and email providers require two factor authentication, I
hope mutt will support this security system!

Doesn't mutt already "support" this? I use Fastmail with 2FA enabled.
What I do then is to generate an app-specific password which is the one
I use in the mutt configuration. There's not much to support, it's just
a different password, unless there's something I'm not getting right.

Yes as far as I am concerned it's on the email provider to give you
app-specific password functionality.

If you want real 2FA, ie you require a token every time you open mutt,
then I would recommend using gpg to encrypt your password and access it
that way.

Then you can use a smart card to store your gpg key (yubikey, nitrokey)
and gnupg will only decrypt your password when it is present.

The benefit of this is that you can use the same key to sign and encrypt
messages. 2 in 1!

As far as I know, TOTP (like Google Authenticator etc) is not part of
the authentication protocols supported by email. What you see as 2-FA
are usually just used to protect web front-ends. I might be way off the
mark though.

[Hokan]

I use LastPass CLI to present my password. I have LastPass protected with 2FA.

My .muttrc contains a line like this:
set imap_pass="`/usr/local/bin/lpass show --password ***@mydomain || sleep 1`"
and
set smtp_pass=$imap_pass

and that works for me.

[Tom Fowle]

Post by Hokan
I use LastPass CLI to present my password. I have LastPass protected with 2FA.
and
set smtp_pass=$imap_pass
and that works for me.
--
Hokan
Bicyclist
Sysadmin

Thanks Hokan,
I'll look into lastpass
Tom Fowle

[Tom Fowle]

Post by Ben Oliver

Post by José María Mateos

Post by Tom Fowle
As more isps and email providers require two factor authentication, I
hope mutt will support this security system!

Doesn't mutt already "support" this? I use Fastmail with 2FA enabled.
What I do then is to generate an app-specific password which is the one
I use in the mutt configuration. There's not much to support, it's just
a different password, unless there's something I'm not getting right.

Yes as far as I am concerned it's on the email provider to give you
app-specific password functionality.
If you want real 2FA, ie you require a token every time you open mutt, then
I would recommend using gpg to encrypt your password and access it that way.
Then you can use a smart card to store your gpg key (yubikey, nitrokey) and
gnupg will only decrypt your password when it is present.
The benefit of this is that you can use the same key to sign and encrypt
messages. 2 in 1!
As far as I know, TOTP (like Google Authenticator etc) is not part of the
authentication protocols supported by email. What you see as 2-FA are
usually just used to protect web front-ends. I might be way off the mark
though.

Thanks, I'll look into this if necessary, but my email is not that critical
I hope.
Tom Fowle

[Tom Fowle]

Post by José María Mateos

Post by Tom Fowle
As more isps and email providers require two factor authentication, I
hope mutt will support this security system!

Doesn't mutt already "support" this? I use Fastmail with 2FA enabled.
What I do then is to generate an app-specific password which is the one
I use in the mutt configuration. There's not much to support, it's just
a different password, unless there's something I'm not getting right.
Cheers,
--
José María (Chema) Mateos
https://rinzewind.org/blog-es || https://rinzewind.org/blog-en

Jose,
In what little I've read, I'd thought one needed to authenticate with two
passwords, but I'm probably wrong.

Thanks, I'll try it if it becomes necessary.
Tom Fowle

[m***@raf.org]

This post might be inappropriate. Click to display it.

[Derek Martin]

Post by Hokan
I use LastPass CLI to present my password. I have LastPass protected with 2FA.
and
set smtp_pass=$imap_pass
and that works for me.

It should be pointed out that this is not really 2FA at all. If I
have your actual user credentials (username & password), say because I
got root access to the machine where you run Mutt and snarfed them out
of memory, this scheme does nothing to prevent me from using them
directly, completely bypassing any 2FA on LastPass. With respect to
the resource to which your credentials give access, there's no second
factor. LastPass is just acting as a proxy for your brain. The only
actual effect it has is to complicate (in a technical sense) the
retrieval of your single authentication factor from your "memory"
(i.e. LastPass' password store)--making it arguably less secure, not
more (because more potential points of failure mean a higher chance
something will break, preventing you from being able to access your
mail). All the security in the world does you no good if the
resources you're protecting are unavailable to legitimate users.

The point of 2FA is to prevent the scenario where an attacker gets your
credentials (user & password, or "the thing you know"), allowing them
to gain access. Examples of how this would be 2FA is if your IMAP
server *additionally* required a cryptographic certificate, hardware
token, sent you a text to your phone, etc.--something that only *you*
should have physical access to. Inability to access that physical
thing (your second authentication factor) still prevents access, even
though your credentials are compromised (known by someone other than
yourself). Like your scheme, this also increases complexity, but
unlike your scheme, it additionally provides a real increase in
security--making the extra complexity involved (arguably) justified.