Mailbox.org now has normal 2FA
Mailbox.org now has normal 2FA
What was previously only available as a beta version for selected testers is now being activated for all customers: the new Login 2.0.
Before today, mailbox.org's 2FA mechanism was unorthodox. In the login screen, you typed in the TOTP in the password field and then added a 4 digit static pin at the end. This got people confused, as it's different than the usual login+password then TOTP. Now it's just like that.
There's also other goodies, like separate passwords for IMAP and SMTP, WebDAV, CardDAV/CalDAV (one password for both), Exchange Sync. Before today, you'd be using your main mailbox.org password for all of the above. Looks like IMAP access is not even possible without creating a separate password https://kb.mailbox.org/en/private/account-article/how-to-use-two-factor-authentication-2fa/
There doesn't seem to be support for the YubiKey TOTP anymore. No passkeys or hardware webauthn either for now.
mailbox.org is based on OpenXchange.
You're viewing a single thread.
Okay, so for those of us using third party apps like Thunderbird, everything is done using app specific passwords, which is great
The new feature for Email App Passwords for external email programmes
But if this is a new feature, how did third party apps work before? Could people just not use them if they enabled 2FA?
Basically, yes, they couldn't use them. The old 2FA had a really weird implementation...
This is just wrong, you used the main account password instead of an app password
You could use third party clients with 2FA enabled in the past (at least I could). I think I used my normal password for the clients, so no real 2FA on that side, but that's no different from the new app specific passwords. IMAP doesn't allow 2FA so every mail provider allowing third party clients essentially has a weak point with no 2FA there.