Add 2FA

[foozmeat]

It would be nice to be able to enforce it server-wide.

[andrewgodwin]

Agreed - this has been on my mental list for a while. I think my current position is TOTP and Webauthn only, SMS two factor would need more provider integration and also isn't amazing anyway.

[foozmeat]

+1 to Webauthn

[pauloxnet]

There's a Django package for that: Kagi Kagi provides support for FIDO WebAuthn security keys and TOTP tokens in Django. https://github.com/justinmayer/kagi

[tabletcorry]

+1 and also consider supporting Passkey/WebauthN only login, where passwords aren't collected or allowed. I would love to have a switch where passwords aren't a concern anymore.

[andrewgodwin]

Good idea @tabletcorry, though we'd need a new reset flow for that situation so you could get back in.

[tabletcorry]

Nod, I think emails would still be attached to the user so the "password reset flow" would become a "add a new passkey" flow when appropriate. Hard to replace email as a core root of identity...

Though for a single-user instance, turning off that flow might be a decent switch since losing a passkey is pretty hard, and some users might want to keep their email quiet (assuming we provide a UPDATE statement they can run on the DB).