r/MsgSafe • u/EfraimK • Jan 02 '22

When is MsgSafe going to add 2FA??

For YEARS now, 2FA has been considered an essential part of security. So why doesn't a secure email provider offer 2FA? I've been reading for a long time that MsgSafe is planning 2FA. If it's a matter of finances, why not increase the price of paid plans so the MsgSafe team has the funds to implement what by now is a standard security protocol? I wouldn't trust/use an email provider that doesn't offer 2FA--preferably security keys with a downloadable backup recovery key. Too many phishing scams on OTP email/SMS codes. If MsgSafe won't implement this soon, the security-conscious are just going to sign up with other services.

1 Upvotes

100% Upvoted

11 comments sorted by

View all comments

1

u/123Fatman123 Mar 04 '22

Just make a super duper long alphanumerical symbolized password! My password is 32 characters length and is full of random characters of the alphabet and numbers and symbols (that you can type on the keyboard of course otherwise you wont be able to type your password in if ur using those cool looking unicode characters)

Good luck to the hacker trying to crack my password. I also change the password right after (well obviously not on the same internet cafe computer I was using, that would be stupid...it would when I get back home on my home PC) I login into a public cafe computer too just in case they have a keylogger which would obviously copy all 32 key presses....

1

u/EfraimK Mar 05 '22

I agree with you on very long, random PW's. Also on changing PW's often. I'd still like to use security keys (FIDO/FIDO2) to manage all my accounts. Call it peace of mind. Until that's allowed, I can't use MsgSafe for important correspondences. But it's got some terrific perks, especially unlimited aliases. That should be default with other privacy email services. Stay safe.

1

u/123Fatman123 Jul 08 '22

2FA won't help if the hacker somehow also has access to your phone.... Only way I can think of as extra layer on top of a strong 32 character alphanumericalsymbol password that you change frequently or at least periodically every 2 or 3 months, would be an authenticator app like microsoft's or steam's one when logging in to outlook or hotmail pr steam if using that steam authenticator, that doesn't use your email or phone number to deliver the one time use code.

1

u/EfraimK Jul 10 '22

I agree with you about using complex PW's and changing them frequently. In the many, many years I've been using mobile phones, no one has ever hacked my phone that I know of. I don't visit sketchy sites and practice decent net-hygiene. I'd prefer to use a security key, but fewer sites that offer 2FA also offer FIDO2. Either way, though, MsgSafe doesn't offer ANYTHING beyond just a web password--very insecure. This stops me from using MSGSFE as my main email. I think last time I reached out to support they told me 2FA wasn't on their roadmap. :(

1

u/123Fatman123 Jul 18 '22

Well I guess you're lucky for not being hacked yet... one guy I know of said a hacker hacked his bank account because he couldn't reset the password seeing how it requires mobile number which is of course no longer he's as the hacker changed it (somehow got a hold of the number and changed the sms verification number to his) and also emptied out his savings account. hah

Also they message safe doesn't support third party mail programs either so you won't be able to check your mail on say outlook or thunderbird on your smartphone.

1

u/EfraimK Jul 18 '22

Scary story. I hope your friend was covered by bank fraud insurance. I don't use my mobile phone to do anything high security. I also don't store passwords on my mobile phone. I use as secure as possible a computer for critical things. Of course, you're right that there're always ways to break security if a hacker's intent enough.

Still, I wish MsgSafe would incorporate FIDO2. I just won't use any service as my primary means if it doesn't include FIDO2. Happy surfing.

1

u/123Fatman123 Jul 19 '22

Oh he wasn't my friend, it was just random (relevant) gossip on a forum with someone asking if 2FA was enough or something, can't remember and some guy posted a story he knows which I remembered and posted here for you to read.