friendica (DFRN) - Link to source

login persistency(?)

hello !Friendica Support, i am wondering why i have to log in to friendica each and every time i open a browser. is this by design, and/or are there options to change that behaviour? (i can not find anything related to that)

cheers,
felix

!Friendica Support

Friendica Support reshared this.

in reply to felix b. ohmann
friendica (DFRN) - Link to source

felix b. ohmann

haha. thanks for that superfast answer! it totally did not occur to me that this checkbox is for staying logged in instead of just storing the login name or something. thanks, and sorry for bothering you with that. but while we are at it, what exactly does the "this device is my 2fa device"-checkbox on the 2fa login change if enabled? i tried, and it seemed to not do anything. what did i miss?
in reply to felix b. ohmann
friendica - Link to source

Hypolite Petovan

Basically both features are based on cookies, and web cookies are some kind of black magic I haven't been to completely master. Normally it should either ask you for both, or none, because both are based on cookies, but I can't guarantee any of it.
Unknown parent
friendica (DFRN) - Link to source

felix b. ohmann

ok, i tried this, if i check "remember me" and "this is my 2fa device" it seems to work as intended. yet, i'd like to question wether the behaviour of throwing a 2fa login at the user while the user stated "remember me" is useful behaviour. friendica is the only web thing i know that decouples 2fa from the login that way.
in reply to felix b. ohmann
friendica - Link to source

Hypolite Petovan

2FA is an added security measure. As such it's pretty much independent from the mail credentials. Since it's easier to use than remember password, you may want Friendica to remember your login/password but have to supply your 2FA regularly to prevent someone to hijack your session.
in reply to felix b. ohmann
friendica - Link to source

Hypolite Petovan

Yes, I do not like this option but it sort of makes sense. When I'm using my phone to browse Friendica, I have my 2FA app on it as well, so the security benefit to ask me for the token on this device is null because anyone with my phone can still log into my Friendica account even if it asks the 2FA token.
in reply to Hypolite Petovan
friendica (DFRN) - Link to source

felix b. ohmann

true. i store my 2fa stuff in a password manager, so there is a layer of security in the form of a long password infront of my 2fa tokens. but that makes it so unpleasant to type the 2fa tokens in more than necessary. i guess there is no right and wrong options here.