Skip to main content

login persistency(?)

hello !Friendica Support, i am wondering why i have to log in to friendica each and every time i open a browser. is this by design, and/or are there options to change that behaviour? (i can not find anything related to that)

cheers,
felix

!Friendica Support

Friendica Support reshared this.

in reply to felix b. ohmann

Tobias
Tobias
• •
When you log in to your account, there is a "remember me" checkbox you can select. If you do so, the cookie should be stored and you should be logged in when you visit the page the next time.
in reply to felix b. ohmann

felix b. ohmann
felix b. ohmann
•
haha. thanks for that superfast answer! it totally did not occur to me that this checkbox is for staying logged in instead of just storing the login name or something. thanks, and sorry for bothering you with that. but while we are at it, what exactly does the "this device is my 2fa device"-checkbox on the 2fa login change if enabled? i tried, and it seemed to not do anything. what did i miss?
in reply to felix b. ohmann

felix b. ohmann
felix b. ohmann
•
also, checking "remember me" does bypass the login screen, but throws me into the 2fa screen to enter a 2fa token if the browser has ben closed since the last session. is that intended?
in reply to felix b. ohmann

Hypolite Petovan
Hypolite Petovan
• •
Basically both features are based on cookies, and web cookies are some kind of black magic I haven't been to completely master. Normally it should either ask you for both, or none, because both are based on cookies, but I can't guarantee any of it.
Unknown parent

felix b. ohmann
felix b. ohmann
•
ok, i tried this, if i check "remember me" and "this is my 2fa device" it seems to work as intended. yet, i'd like to question wether the behaviour of throwing a 2fa login at the user while the user stated "remember me" is useful behaviour. friendica is the only web thing i know that decouples 2fa from the login that way.
Unknown parent

Hypolite Petovan
Hypolite Petovan
• •
You remembered the intention right!
in reply to felix b. ohmann

Hypolite Petovan
Hypolite Petovan
• •
Do you mean that you shouldn't be asked for a 2FA token if you checked the "Remember Me" box?
in reply to Hypolite Petovan

felix b. ohmann
felix b. ohmann
•
yes, since the 2fa is just another layer of security for the login, what good is the "remember me" function if it only remembers halfway? :)
in reply to felix b. ohmann

Hypolite Petovan
Hypolite Petovan
• •
2FA is an added security measure. As such it's pretty much independent from the mail credentials. Since it's easier to use than remember password, you may want Friendica to remember your login/password but have to supply your 2FA regularly to prevent someone to hijack your session.
in reply to Hypolite Petovan

felix b. ohmann
felix b. ohmann
•
ok, i get that, but the user experience is not great. maybe in the future this can be something that the user can choose in his options; wether it is linked to login or not. right now i can abuse the "this is my 2fa device" for that.
in reply to felix b. ohmann

Hypolite Petovan
Hypolite Petovan
• •
Yes, I do not like this option but it sort of makes sense. When I'm using my phone to browse Friendica, I have my 2FA app on it as well, so the security benefit to ask me for the token on this device is null because anyone with my phone can still log into my Friendica account even if it asks the 2FA token.
in reply to Hypolite Petovan

felix b. ohmann
felix b. ohmann
•
true. i store my 2fa stuff in a password manager, so there is a layer of security in the form of a long password infront of my 2fa tokens. but that makes it so unpleasant to type the 2fa tokens in more than necessary. i guess there is no right and wrong options here.
in reply to felix b. ohmann

Hypolite Petovan
Hypolite Petovan
• •
Yes, it's all about tradeoffs between convenience and security. 2FA mostly prevents remote logins with stolen credentials, but your mobile device security is another matter entirely.
⇧