<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body dir="auto">Problem is that not many client support it - especially mobile ones.<div dir="auto">So wireguard VPN is the way to go, much simpler for the users.</div><div><br></div><div align="left" dir="auto" style="font-size:100%;color:#000000"><div>-------- Originalmeddelande --------</div><div>Från: Rick Romero <rick@havokmon.com> </div><div>Datum: 2021-07-15 17:04 (GMT+01:00) </div><div>Till: dovecot@dovecot.org </div><div>Ämne: Re: Sv: 2FA/MFA with IMAP & postfix/submission </div><div><br></div></div>
<p>Quoting Alex <<a href="mailto:mysqlstudent@gmail.com">mysqlstudent@gmail.com</a>>:</p>
<blockquote type="cite" style="border-left:2px solid blue;margin-left:2px;padding-left:12px;">
<p>Hi,<br></p>
<blockquote type="cite" style="border-left:2px solid blue;margin-left:2px;padding-left:12px;">
<p>Unfortunately the best way to do multifactor authentication today is to use OAUTH2, which isn't currently supported for own installations. Or you can use client certs.<br>
<br>
If you want to use some kind of MFA with tokens, you end up having to feed your token all the time. So the best option, for now, is device passwords.</p>
</blockquote>
Client certs appears to be a good solution.<br>
<br>
What's the process for managing them with more than a hundred client accounts?<br>
<br>
I believe the problem they are trying to solve is hacked accounts from<br>
compromised passwords. Does client certs solve that problem?</blockquote>
<p>Client certs would solve that - but you'll need some management around it (creation/deployment/renewal/device changes/etc). The easiest method is to run MDM and PKI infrastructure, but with 100 clients I kinda doubt that's in place and I wonder if they have the budget for it.<br>
<br>
Another option, not open source, but if you engage Recorded Future, you can get a report and notifications of password compromises, and then take action on that info (ie, force affected user to change password).<br>
<br>
Alternatively, and free, don't use the email address as the username for authenticaiton, use some other generic ID.<br>
<br>
Rick</p>
</body></html>