#Immich does not have 2FA and the devs made clear, it's not coming.
-
@hrafnagud @tandemblog @panda @homelab
But but, TOTP is much simpler to implement and does not have several changes or does not need many updates. OAUTH can change implementation logic and unless kept updated by the user, it may not work or may lock one out (I guess). These are pics, which are sensitive and have several data which can be parsed. TOTP obviously is not hard to implement.
Also, TOTP can be implemented once, and not updated, it will still work.@fbinin @hrafnagud @panda @homelab Furthermore I like to manage my credentials and MFA settings in one place instead of in multiple applications. My services a home grew to the point I already have 14 applications using Keycloak as OTP service. Additionally a Single Sign On requires less support for family members. (I'm aware not every one wants to operate so many applications)
-
#Immich does not have 2FA and the devs made clear, it's not coming.
The reasoning against #2FA is pretty weak.
This thread is
️ (for me). Points were made. -
-
@panda @hrafnagud @homelab I want state-of-the-art security for all users, but I also understand developers' positions. I initially implemented multiple login methods in my applications by using existing libraries, but this got too hard to keep up to date, especially when I tried to integrate WebAuthn/Passkeys. Therefore, I started using OAUTH and delegated the hard part of different login methods.
My proposal is to make security easy by referring to simple, and easy-to-set-up OAUTH services.I initially implemented multiple login methods in my applications by using existing libraries
I'd really just need one TOTP slot. No WebAuthn, Passkeys or whatever. Just a single means of 2FA.
OAuth / OIDC is great. 100%. I just think it's not a good idea to provide a login with username + password, but then not provide TOTP.
Just remove user+pass auth entirely and rely solely on OAuth/OIDC, if user+pass cannot be secured with TOTP / what ever.
-
I initially implemented multiple login methods in my applications by using existing libraries
I'd really just need one TOTP slot. No WebAuthn, Passkeys or whatever. Just a single means of 2FA.
OAuth / OIDC is great. 100%. I just think it's not a good idea to provide a login with username + password, but then not provide TOTP.
Just remove user+pass auth entirely and rely solely on OAuth/OIDC, if user+pass cannot be secured with TOTP / what ever.
@panda @tandemblog @hrafnagud @homelab Exactly, that‘s why i‘m rolling out pocket-id for all my personal services. https://pocket-id.org #pocketid
-
-
-
@preya @panda @homelab I create an album, add some pictures, and can then share it with other users on the same instance. I can set whether they can only view or also edit the album. If so, they can also add pictures etc
I know that there is an "external library" but this is for a different purpose and doesn't provide the functionality of a shared album.
-
@preya @panda @homelab I create an album, add some pictures, and can then share it with other users on the same instance. I can set whether they can only view or also edit the album. If so, they can also add pictures etc
I know that there is an "external library" but this is for a different purpose and doesn't provide the functionality of a shared album.
@abulling @panda @homelab This has been a feature for ages. Not sure why you think that's missing. It's even described here in the docs: https://docs.immich.app/features/sharing/
-
@abulling @panda @homelab This has been a feature for ages. Not sure why you think that's missing. It's even described here in the docs: https://docs.immich.app/features/sharing/
-
@preya @panda @homelab Ah, right. Now I remember what the issue was (it's been a long time since I last looked into this but my browser history showed what I had been looking into):
https://odd.blog/2026/01/16/creating-a-shared-photo-library-in-immich/
"While Immich has shared albums, they don’t quite solve this problem. The photos don’t appear in search and aren’t processed for face recognition or analysis."
The article proposes a solution based on an external library. That's why I still remembered this "solution"...
-
@fbinin @hrafnagud @panda @homelab But a good TOTP implementation takes some effort too if you want to support multiple devices and recovery codes. The library updates are probably not because of TOTP itself, the might be required due to the libraries dependencies or framework integrations. Furthermore, if TOTP is implemented, why not add WebAuthn/Passkeys too?
@tandemblog @hrafnagud @panda @homelab
1 at a time tbvh.
I mean TOTP first, so that at least the basic need is implemented. Rest can come at a later stage if possible. The more ask gets chipped, the more the word NO gets chanted by the devs.I do understand it all can be done. It also begs the question of a maintainer. Even smaller changes or updates at times may break something. One reason why I said, just implement the basis TOTP at least.
-
@fbinin @hrafnagud @panda @homelab Furthermore I like to manage my credentials and MFA settings in one place instead of in multiple applications. My services a home grew to the point I already have 14 applications using Keycloak as OTP service. Additionally a Single Sign On requires less support for family members. (I'm aware not every one wants to operate so many applications)
@tandemblog @hrafnagud @panda @homelab
Very true. Not everyone likes to have so many things. I have 40+ TOTPs myself. -
@preya @panda @homelab Ah, right. Now I remember what the issue was (it's been a long time since I last looked into this but my browser history showed what I had been looking into):
https://odd.blog/2026/01/16/creating-a-shared-photo-library-in-immich/
"While Immich has shared albums, they don’t quite solve this problem. The photos don’t appear in search and aren’t processed for face recognition or analysis."
The article proposes a solution based on an external library. That's why I still remembered this "solution"...
-
@preya @panda @homelab Ah, right. Now I remember what the issue was (it's been a long time since I last looked into this but my browser history showed what I had been looking into):
https://odd.blog/2026/01/16/creating-a-shared-photo-library-in-immich/
"While Immich has shared albums, they don’t quite solve this problem. The photos don’t appear in search and aren’t processed for face recognition or analysis."
The article proposes a solution based on an external library. That's why I still remembered this "solution"...
-
-
@abulling @vb @preya @panda @donncha Just in case you want to track this, note that this seems to be the #1 item in the Immich roadmap (not that I think order is that important): https://immich.app/roadmap
And is being tracked here: https://github.com/immich-app/immich/issues/12614I haven't decided yet on Immich vs Ente Photos here.
-
-
@thedoctor @vb @preya @panda @homelab @donncha Tried it as well. Didn't like it either.
Immich is by far the most promising/nice looking software for this in my opinion. But (so far) it still lacks several features that unfortunately prevent me from switching to it completely.
We need user groups - otherwise sharing albums etc is a nightmare once you have more than a handful of people using it.
And shared albums should offer the same functionality as "normal" ones. I don't want to have duplicates or miss out images that show a particular person because Immich can't run duplicate/face detection in shared albums.
-
@preya @panda @homelab Ah, right. Now I remember what the issue was (it's been a long time since I last looked into this but my browser history showed what I had been looking into):
https://odd.blog/2026/01/16/creating-a-shared-photo-library-in-immich/
"While Immich has shared albums, they don’t quite solve this problem. The photos don’t appear in search and aren’t processed for face recognition or analysis."
The article proposes a solution based on an external library. That's why I still remembered this "solution"...
@abulling
I think the immich fork Noodle improves this.
️ 
