Add 2FA

Kai

Add 2FA to the login.
(TOTP, U2F)

NS2555

if some kind of a kagi client for mobile comes out (like the Google app on android for example), i think it would be nice if you could authenticate on other devices by scanning a qr code, or by popping up a one time 2fa code like steam does for example

eh

I think implementing 2FA is especially pertinent once Kagi is storing some kind of payment information.

z64

eh We won't be storing any payment information. It is all stored offsite by Stripe.

BoundlessManor

+1 to this. 2FA is the bare minimum when you have an account on any website IMO.

MagicMouse

Do we have an ETA on this? TOPT and FIDO2 support would be a very welcomed addition. I appreciate that payment information is handled by stripe but, if an account is compromised, there is still some sensitive information that will be accessible, including post/zip code, address, and legal name.

David

I would really like to see this implemented in Kagi.

resurface2

Deleted Message

vicky

I'd love to see two-factor authentication implemented. It would undoubtedly aid in enhancing account security.

Vlad

We wil prioritize this in August, this has been the most requested feature.

STM

Can you exclude 2FA from token logins? Otherwise I will not be able to use 2FA, because I rely on private Firefox tabs on Android and since there's no Kagi addon for Firefox mobile yet (or rather it is not whitelisted), I have to add the login token to the search string. Requiring 2FA here would mean I had to reauthenticate every time I search in a private tab.

z64

STM No plans for opening a session link to require 2FA confirmation.

Our plan is to balance this by requiring more sensitive parts of the app to go through a password/2FA wall, such as billing, email change, etc.

somerandomuser

Can you please add webauthn (passkeys) support when working on that so that we can use Yubikeys as 2FA?

z64

somerandomuser Just TOTP is planned for our initial release of this feature. It is nearly ready to ship, and we don't want to keep all the folks waiting for TOTP longer 😄

Further auth methods to come in future passes, and should not take as long as we've built the foundation for it now. But we hear you, our devs use Yubikeys too, we'd love to support it.

Repacking6528

z64 once it's been added you should get yourselves added on https://2fa.directory 🙂

spicytuna

Sweet. And another +1 here looking forward to Webauthn.

cempack

Are you still intending to incorporate that feature? It represents the essential minimum security standard for a privacy-focused search engine.

Vlad

cempack Yes, coming next week.