Welcome to the FogBugz Knowledge Exchange

Question

22

This is a request for FogBugz to natively have a two factor auth mechanism, and not to rely on third party tools.

Because our team is distributed, we have to make our FogBugz system accessible over the internet. This means the system is vulnerable to password theft by anyone in the world.

As Bill Gates and others have said: Passwords are dead. They are vulnerable in 100 ways.

Further, some of our remote users share passwords with each other (where two remote folks are using a single login on our FB system, which we frown on, but cannot prevent... without two factor).

We believe the data in our fogbugz system is at least as valuable as what is in our email. Gmail has two factor auth (which I use, and like). We believe that FogBugz should have it too.

The way Gmail implemented two factor is attractive, because they allow the user to authorize a given browser (on a given machine) for up to 30 days from a single two-factor login. This is a nice balance between security and usability.

We host FB on our own server, and currently run v 8.6.50 on a Windows 2003 server.

Thanks!

Case FC2204017

edited Mar 30 at 14:02

adambox♦♦
21k●15●48

asked Jan 4 at 17:24

sam jones
906●3●12

	(By "third party tools" Sam means PhoneFactor: fogbugz.stackexchange.com/questions/9389/…) – Michel de Ruiter♦ Jan 4 at 20:15
	Why not just use a VPN? – Greg Saven♦ Jan 8 at 0:01
	Greg Savan: Because VPNs are a hassle to use. We would need to set up 10+ vpn clients, for just 15 users, to cover off site users, and on site users who also access from off site. Also, vpn's don't really help accessing FB from phones.... – sam jones Jan 9 at 3:36
	We will do this if there is compelling user support behind it (i.e., more than one verifiable user is vocal about it). But we have to say for now that the outlook is not good. – Rich Armstrong♦ Feb 21 at 14:27

Rich Armstrong · Answer 1 · 2012-01-05 18:17:43Z UTC

1

This is not a dupe of the phone factor request, which was deferred. This request should have its day in court and compete with other features. We'll happily file this when it reaches our top 100 feature requests by votes.

answered Jan 5 at 18:17

Rich Armstrong♦♦
13.1k●12●29

Jason Rinald · Answer 2 · 2012-01-05 23:31:34Z UTC

I know you mentioned not relying on Third Party tools but you should look into TeleSign. They are a completely cloud based authentication piece. You would store the phone number and device info, as well as the last authentication and only send an API request for a call or SMS when you decide it is needed. Their service is great and reliable. It looks like they power a lot of the top websites.

Feature Request: Native Two Factor Authentication, (like GMail two factor, etc)

2 Answers