<html><head><style id="outgoing-font-settings">#response_container_BBPPID{font-family: initial;font-size: initial;color: initial;}</style></head><body style="background-color: rgb(255, 255, 255); background-image: initial; line-height: initial;"><div id="response_container_BBPPID" style="outline:none" dir="auto" contenteditable="false"> <div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"> The thing I don't like is most 2FA token generators. Ultimately you need to transfer the polynomial that generates the code. Most do that with a QR image. Well so much for security! Others have a one time emergency code. Of course we are talking evil maid attacks, which granted is an unacceptable term these days. </div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">Now Yubikey at least has my attention. But people often leave the key plugged into their notebook. Very true with the Google equivalent which I have heard from Google employees. The keys themselves aren't exactly transferable, but when you have physical access then all bets are off. </div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">If someone fool actually paid me to be sysadmin, I would use a Yubikey. </div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">Note Freeotp let's you input the code but also has the QR code fallback. The phone app however hasn't been updated in years. It does allow you to test out a TOTP scheme. It took me no time to write a script to accept the token on Linux. The tricky part if I recall correctly was setting up the script to accept the token that just expired. You would want to do that to minimize user friction. </div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">Not to get too far off track but I don't allow any web control over my email server. There is no control panel to hack. I ssh into the server and that uses PKI. I do everything via CLI. If ssh is compromised then nothing else will be secure so email would be the last of my problems. </div> <div id="response_div_spacer_BBPPID" dir="auto" style="width:100%"> <br></div><div id="response_div_spacer_BBPPID" dir="auto" style="width:100%">Companies such as Last pass (not an endorsement but an example) supposedly incorporate password generators. If you are going to allow users to set let alone change their own password, you might be able to write a script that generates the password. </div><div id="response_div_spacer_BBPPID" dir="auto" style="width:100%"><br></div><div id="response_div_spacer_BBPPID" dir="auto" style="width:100%">If I were to go up to the next level of security I would use mail-crypt. It is just that I see so much chatter about getting it to work. </div> <div id="blackberry_signature_BBPPID" dir="auto"> <div id="_signaturePlaceholder_BBPPID" dir="auto"></div> </div></div><div id="_original_msg_header_BBPPID" dir="auto"> <table id="_pHCWrapper_BBPPID" width="100%" style="border-spacing:0px;display:table;outline:none" contenteditable="false"><tbody><tr><td colspan="2"> <div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb( 181 , 196 , 223 );padding:3pt 0in 0in;font-family:'tahoma' , 'bb alpha sans' , 'slate pro';font-size:10pt"> <div id="from"><b>From:</b> montneytyler@gmail.com</div><div id="sent"><b>Sent:</b> November 13, 2021 3:03 PM</div><div id="to"><b>To:</b> dovecot@dovecot.org</div><div id="subject"><b>Subject:</b> Re: Strategies for protecting IMAP (e.g. MFA)</div></div></td></tr></tbody></table> <br> </div><div dir="auto" style="outline:none" contenteditable="false"><div dir="ltr">"Use strong (as in long and/or randomised and impossible to break using<br><div>
rainbow table attacks) password"</div><div><br></div><div>Again, since it's just me, this is do-able. But I'm looking for something practical as well.</div><div>I'm getting the feeling that people don't have an MFA implementation.<br></div><div><br></div><div>"if the users are sufficiently discipline"</div><div><br></div><div>As a Sysadmin, I can tell you they genuinely are not and they likely never will be.</div><div>Hope for the best, plan for the worst.</div><div><br></div><div>I also want to clarify that I'm not rejecting any of these suggestions, they're all good.<br>
</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Nov 13, 2021 at 4:42 PM Ralph Seichter <<a href="mailto:ralph@ml.seichter.de">ralph@ml.seichter.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb( 204 , 204 , 204 );padding-left:1ex">* Tyler Montney:<br>
<br>
> Since this is getting increasingly complicated, I wanted to ask before<br>
> going further. What do you all do? Any recommendations?<br>
<br>
Use strong (as in long and/or randomised and impossible to break using<br>
rainbow table attacks) passwords which are used only once (!) and kept<br>
either in the user's brain or in an encrypted password store. Ensure<br>
that authentication data can only be transmitted over encrypted<br>
connections.<br>
<br>
These measures cover a lot of ground, if the users are sufficiently<br>
disciplined. Users are usually the weakest link.<br>
<br>
-Ralph<br>
</blockquote></div>
</div></body></html>