Increase account security (2FA, App Passwords, Password Rules)

[jwgn]

Hi,

I want to enforce three things for increased account security for new users:

1. Force Users to login to the Self-Service-Portal to activate 2-factor-authentication before they can use the account
2. Disable JMAP / IMAP / SMTP authentication via user password. Force users to use App Passwords or OAuth instead
3. Define a password policy for password changes

I did not find these options in the webinterface. Is there a way to accomplish this?

[mdecimus]

Hi,

This is not supported because 2FA requires OAuth and, in order to use OAuth, you need a mail client supporting the OAUTHBEARER SASL mechanism. Unfortunantely none of them do (there are few exceptions, some webmail clients and JMAP clients do). I suggest you read this page explaining the details.

Basically, even if you force all your users to use 2FA, they will end up using AppPasswords because no mainstream mail client supports OAuth. And, since App Passwords are like regular passwords, there is no point in adding a feature to enforce increased security.
If in the future we start seeing more clients support OAuth, then this feature could be considered.

[jwgn]

Thanks for your answer.

Basically, even if you force all your users to use 2FA, they will end up using AppPasswords because no mainstream mail client supports OAuth. And, since App Passwords are like regular passwords, there is no point in adding a feature to enforce increased security.

I do see one advantage in enforcing app passwords. If different App Passwords are used for different devices, one can simply revoke that app password if the device gets lost. If the normal user password is used, it has to be changed on every device that accesses the account.

Google has already implemented that. You cannot use your account password anymore when 2 factor authentication is enabled on the account:

Invalid login: 534-5.7.9 Application-specific password required

[mdecimus]

@jwgn Feel free to create an enhancement request for this feature. I am not against it, hopefully one day IMAP clients will support OIDC.