Before today, mailbox.org’s 2FA mechanism was unorthodox. In the login screen, you typed in the TOTP in the password field and then added a 4 digit static pin at the end. This got people confused, as it’s different than the usual login+password then TOTP. Now it’s just like that.
There’s also other goodies, like separate passwords for IMAP and SMTP, WebDAV, CardDAV/CalDAV (one password for both), Exchange Sync. Before today, you’d be using your main mailbox.org password for all of the above. Looks like IMAP access is not even possible without creating a separate password https://kb.mailbox.org/en/private/account-article/how-to-use-two-factor-authentication-2fa/
There doesn’t seem to be support for the YubiKey TOTP anymore. No passkeys or hardware webauthn either for now.
mailbox.org is based on OpenXchange.
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
Additional Resources:
Bit of trivia but I think I know why the 4 digit pin thing existed! It’s an out-of-the-box feature on freeRADIUS, I ran across it in a pfsense environment in the past. I thought it was neat (esp. in the absence of passwords, this was primary auth with public keys and then 2fa on top) but ultimately too convoluted for most users