Post by Tom FowlePost by José MarÃa MateosPost by Tom FowleAs more isps and email providers require two factor authentication, I
hope mutt will support this security system!
Doesn't mutt already "support" this? I use Fastmail with 2FA enabled.
What I do then is to generate an app-specific password which is the one
I use in the mutt configuration. There's not much to support, it's just
a different password, unless there's something I'm not getting right.
Cheers,
--
José María (Chema) Mateos
https://rinzewind.org/blog-es || https://rinzewind.org/blog-en
Jose,
In what little I've read, I'd thought one needed to authenticate with two
passwords, but I'm probably wrong.
Thanks, I'll try it if it becomes necessary.
Tom Fowle
tl;dr
-----
2FA/MFA = what you know + what you have + what you are.
2 passwords = 2 * what you know = 1FA.
2FA/MFA is mostly for websites, not pop/imap.
however, pop/imap + tls + client certificate = 2FA/MFA (?).
however, can't really see that happening.
off-topic nonsense about credential stuffing, 2FA/MFA, password managers.
long version
------------
2FA/MFA isn't two passwords. It's something you know (like
usernames and passwords) and something you have (like access to
an email account or mobile/cell/handy phone), and/or something
you are (like fingerprints or iris patterns or voice pstterns).
Two passwords is just two of something you know so it's still a
single factor.
However, it should be pointed out that 2FA/MFA is mostly for
websites. The IMAP/POP protocols have no support for it. It's
unlikely that the POP/IMAP protocols will be changed to
incorporate 2FA/MFA. And until that happens, I doubt there's
much that mutt (or POP/IMAP servers) can do about it.
Actually, I'm probably completely wrong about that. It's
probably quite possible for a POP/IMAP server to require the use
of TLS and to require that you have a client certificate that it
recognises as well as your username and password. That would be
2FA/MFA and mutt might not even need to know about it. The
underlying TLS library would take care of it. But the email
service provider would have to have some way of issuing you with
a client certificate and instructions on how to install it.
If the client certificate is encrypted then mutt might need
to know about it to support gathering the passphrase needed
to decrypt the client certificate. I don't know.
But I can't see too many email service providers requiring all
of their users to install (and possibly encrypt) client
certificates on all of their devices where they read email.
But it could be an opt-in thing where if you ask for a client
certificate, then you always need to use it.
<SLIGHTLY_OFF_TOPIC_2FA_MANSPLAINING_NONSENSE>
The biggest threat that is mitigated by 2FA/MFA is credential
stuffing where someone hacks one website, steals the usernames
(usually email addresses) and passwords, cracks the passwords,
then re-uses them on all the other websites to see if they work.
Last I heard, 40% of website logins attempts worldwide are
automated using stolen credentials. The attempts that succeed
are worth more in criminal markets than untested stolen
credentials. Where there's a business model, there's a way.
Credential stuffing is here to stay.
The best defense against this is for all websites to store
passwords in a way that can't be cracked or at least can't be
cracked without spending vast sums of money on hardware (e.g.
scrypt+hmac). But of course website users have no control over
that.
Just having unique strong passwords for every website is enough
to mitigate against credential stuffing. Real 2FA/MFA is more
for protecting against attacks that target you specifically. But
even then, some 2FA/MFA systems send an email with a code to an
email account that you might only have 2FA/MFA access to, but
most send a text message and, at least in Australia, it's very
easy to steal someone's mobile/cell/handy phone number (not the
handset, just the number), so 2FA/MFA doesn't really protect
against targeted attacks either. So it only really protects
against credential stuffing. But it does make targeted attacks
harder to perform so it is worthwhile for that too.
Anyway, if you're just concerned about credential stuffing, use
a password manager and use it (or at least unique strong
passwords) for any POP/IMAP accounts you have as well as for any
website accounts.
I think the reason that some websites require 2FA/MFA is because
they can't force you to use strong unique passwords for every
website. But if you choose to use strong unique passwords for
everything, then you don't really need 2FA/MFA (unless you also
want to defend yourself against targeted attacks by people who
aren't willing to put too much effort into the targeted attack).
Having said all that, 2FA/MFA may well be easier than using a
password manager. If so, that's a good enough reason to use it
everywhere you can or at least everywhere important. However, if
you can't use it, use a password manager and strong unique
passwords. Or both.
</SLIGHTLY_OFF_TOPIC_2FA_MANSPLAINING_NONSENSE>