Before today, mailbox.org’s 2FA mechanism was unorthodox. In the login screen, you typed in the TOTP in the password field and then added a 4 digit static pin at the end. This got people confused, as it’s different than the usual login+password then TOTP. Now it’s just like that.
There’s also other goodies, like separate passwords for IMAP and SMTP, WebDAV, CardDAV/CalDAV (one password for both), Exchange Sync. Before today, you’d be using your main mailbox.org password for all of the above. Looks like IMAP access is not even possible without creating a separate password https://kb.mailbox.org/en/private/account-article/how-to-use-two-factor-authentication-2fa/
There doesn’t seem to be support for the YubiKey TOTP anymore. No passkeys or hardware webauthn either for now.
mailbox.org is based on OpenXchange.
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
Additional Resources:
Well fucking finally. I have no idea what took them so long.
I think they resell https://www.open-xchange.com/ so they were dependent on them accomodating Keycloak (identity solution used by mailbox)
I’m not sure I quite understand how this would make them unable to support normal 2fa until now.
Keycloak is one of the most configurable and flexible auth solutions, and there is no way it didn’t support otp based 2fa until recently.