[Feature] Add 2FA/TOTP

[ln-12]

I have searched the existing feature requests to make sure this is not a duplicate request.

• Yes

The feature

This is a follow-up feature request to #729 and #880 which are both over 2 years old now. I know that there is OAuth integration since v1.36.0 and you pointed to that in the past when asked for a 2FA implementation.

However, I would like to ask if you could re-evaluate this stand point. In my opinion, there should be a way to host Immich without any extra configuration regarding user authetication that supports a second factor (I think we can agree that using only username + password can not be considered to be safe). Currently, I would need to setup, integrate and maintain a service like Authelia, Authentik, KeyCloak or similar "only" to have a second factor when logging into Immich.

What do you think? Would it be an option to integrate TOTP as second factor in the future?

Platform

• Server
• Web
• Mobile

[mmomjian]

Hi, thanks for your request. This was revisited a month ago in #8175 and our position has not changed. Thanks for understanding.

[ln-12]

Well, that's a bummer. I don't really get it. Implementing 2FA once in a secure way in Immich should be a possible thing to do. On the other side every user now has to setup an own OAuth service that has to be configured in a safe way. I am not sure that I could setup such a service without overlooking any possible misconfiguration 🫤

[mmomjian]

I use fail2ban. It was easy to setup

[ln-12]

How should that be equivalent to a second factor? Wouldn't it only block failed attempts any maybe attempts from foreign countries?

[mmomjian]

What’s your goal of a second factor?

• prevent brute force attempts (F2B works)
• Prevent a leaked password (use a unique password for immich, using a locally encrypted password manager)

I don’t think 2FA, while a good practice, effectively protects you from many additional threat models in a self hosted setup like this.

[ln-12]

I care about both cases. And sure, I already use unique passwords in combination with a password manager. Also, I store TOTP codes in a YubiKey instead of some software (e.g. an app on my smartphone).

I see your point. When you prevent brute forcing by using fail2ban and protect your password there should be nothing to worry about. Bout how do you make sure that you password is actually safe? What about a compromised device (some kind of virus/malware/0-day/...)? Can you be 100% sure that your password will never ever be leaked? I cannot. We are talking about super sensitive information here (not only the photos/videos themselves but also the metadata like geo position). With a s second factor, there would always be a second line of defense even if my password got somehow compromised.

And if the only argument against 2FA is that it is hard to get right, how are you then confident that the username + password implementation is correct and safe? What speaks against implementing 2FA and have an audit for it? And once implemented, you don't change code like that all the time, changes should be rare (if there are some at all).

Don't get me wrong, I absolutely love Immich as replacement for other photo services. But I just don't get why you are against this de facto standard.

[mmomjian]

• if there was a zero day on my device, the immich app and all the photos on my phone are exposed
• you can't be confident. Thats why the sysadmin is responsible for setting up proper monitoring and OAuth if desired. Adding 2FA will not change this.
• I'm not against it and if it was added I would use it. I use 2FA for tons of logins. But I understand why we made this decision, which allows us to focus on building Immich
• If someone wants to audit our code base, we would welcome it. It's fully open source.

[ln-12]

Thanks for your explanation and taking the time to answer my questions!

I am not only talking about a smartphone (which has the app installed and content cached) but also about computers that only have some kind of password manager which could be compromised but no local content. The only way to access Immich in that case would be via credentials. A second factor would effectively block this attack vector.

Ok, but if you say that your current implementation could be potentially insecure how would adding 2FA make it less secure? If you can't guarantee it in the first place, I don't really see how this argument holds up.
Also, I did not mean to audit the whole code base (which would obviously be the best scenario) but only a potential PR that implements 2FA. That way it could be verified that the system does at least not get less secure.

One last point:

which allows us to focus on building Immich

Does that mean you reconsider this topic once Immich is stable and you completed your current roadmap?

[mmomjian]

There are no current plans to reevaluate that I am aware of. Otherwise I am going to stop here, take care.