Security Features
complete
B
Ben Kelly
This is the second platform I've tried to sign up for that doesn't support the most basic of security features such as MFA, or preferably SAML.
SAML is a bit of a luxury but it's simply not acceptable to offer a platform that will store PII in this day and age and not have MFA as a day 1 feature.
I will not be putting any of my customers data in this platform until this is rectified.
Log In
Michael Adrian
updated the status to
complete
Michael Adrian
Heard you. Got MFA out the door, live now on 0.4.34:
- Authenticator app MFA (TOTP), QR code + manual key setup
- Recovery codes if you lose your authenticator
- Company-wide enforcement, turn it on and your whole team gets forced to set it up next login
- Admins can see MFA status per user and reset it remotely
- Replay protection so a code can't be reused twice
- Secrets and recovery codes encrypted server side, never touch the client
Also locked down offline mode with a separate PIN, it used to just rely on the session staying open which wasn't great either.
SAML, you said it yourself, not urgent for most people right now but it's on the list. Not gonna promise a date though, rather be straight with you than string you along.
This was already on the list as part of the Cyber Essentials/ICO certification work we're doing, so more of this kind of thing is coming, not a one off.
Thanks for the push, keeps us honest.
Shout if there's anything else you need or want to see implemented.