Is multi factor authentication practical/feasible?

Aki Tuomi
Thu, 07 Jul 2022 11:24:33 -0000

> On 07/07/2022 01:12 EEST Michael Peddemors <michael at
linuxmagic.com> wrote:
>
>
> On 2022-07-06 10:17, gene heskett wrote:
> >> As far as I can see from what I tested today (mainly switching my
> >> Thunderbird from "Normal Password" to
"OAuth"), Clients effectively
> >> *have* to be "also a browser" (rendering the HTML for
O365's login
> >> prompts, accepting and sending user input, storing the OAuth token
as
> >> a HTTP cookie) to be able to do that. SMTP remains exempt from the
> >> requirement for now, on the theory that printers and the like may
want
> >> to use it, and not be up to implementing the new stuff.
(Otherwise,
> >> MS' position can be summarized as "our clients work
great, Thunderbird
> >> succeded in implementing it, if your client doesn't, go nag
the vendor".)
>
>
> > And one more time we have allowed a sworn enemy to set the standard,
> > shame on us.
>
> Getting a little off topic, but yes.. I believe Dovecot also sees the
> threat for all it's users, if authentication processes are forced in a
> direction that only favours the big three.
>
> Which is why I hope it gets more open with allowing 3rd parties to
> contribute to Dovecot as plugins, that support other methods of 2FA..
>
> Sworn Enemy? Not if you have shares in your 401k/RRSP they aren't.
> These are smart business moves to consolidate the market for them, which
> in turn means stock prices go up.
>
> But it will be a terrible world, if interoperability between independent
> email providers, and the big three area threatened, or if they are
> forced to 'drink the koolaid'.
>
> But it is nice to see products like Thunderbird and other supporting
> alternative means of 2FA, just like to see Dovecot support them as well
> natively, or through plugins.
>
> Just my two bits..
>
>

FWIW I think OAuth2 is the modern way to do actually MFA authentication.  There
is some progress in Mozilla world (and hopefully other mail clients) to allow
OAuth2 to work outside the "big three" circle. Mostly this is *client
development issue*, the server-side already mostly supports all the bits you
need to roll your own MFA with OAuth2 using off the shelf components. No need to
pay microsoft or google.

Alternate to OAuth2, which works pretty well today, is to use device passwords.

Also, Michael's code that we would love us to merge, will possibly some day
be merged, and hopefully he will provide the client-side of it to benefit the
community too?

Aki