#Immich does not have 2FA and the devs made clear, it's not coming.

[panda@pandas.social]

#Immich does not have 2FA and the devs made clear, it's not coming.

The reasoning against #2FA is pretty weak.

This thread is ️ (for me). Points were made.

#infosec @homelab

[hrafnagud@runespaces.com]

@panda @homelab What's the specific reason? External solutions via OAUTH are preferred?

[panda@pandas.social]

@hrafnagud

External solutions provide better authentication and should be preferred.

I do get the point and a line has to be drawn. I just don't share this sentiment entirely, because TOTP e.g. is not that hard to implement.

Sure it's a photo and not a authentication app... but .. you know... it might be preferable to add a means of 2FA for people who don't want to manage an sso provider.

@homelab

[hrafnagud@runespaces.com]

@panda @homelab I'm with you - 2FA shouldn't be that hard to implement considering users who don't want (or can't) implement OAUTH. I use my instance with PocketID so I don't care but from a security point of view you're definitely right here. Implementation shouldn't cost that much resources and would be a secure base for "normal" users of Immich.

[panda@pandas.social]

@hrafnagud

Running authentik at the moment. PocketID sounds neat.

@homelab

[tandemblog@social.kobelnet.be]

@panda @hrafnagud @homelab I want state-of-the-art security for all users, but I also understand developers' positions. I initially implemented multiple login methods in my applications by using existing libraries, but this got too hard to keep up to date, especially when I tried to integrate WebAuthn/Passkeys. Therefore, I started using OAUTH and delegated the hard part of different login methods.
My proposal is to make security easy by referring to simple, and easy-to-set-up OAUTH services.

[hrafnagud@runespaces.com]

@tandemblog @panda @homelab Good point - thanks for sharing your thoughts on that one!

[fbinin@mastodon.fbin.in]

@hrafnagud @tandemblog @panda @homelab
But but, TOTP is much simpler to implement and does not have several changes or does not need many updates. OAUTH can change implementation logic and unless kept updated by the user, it may not work or may lock one out (I guess). These are pics, which are sensitive and have several data which can be parsed. TOTP obviously is not hard to implement.
Also, TOTP can be implemented once, and not updated, it will still work.

[tandemblog@social.kobelnet.be]

@fbinin @hrafnagud @panda @homelab But a good TOTP implementation takes some effort too if you want to support multiple devices and recovery codes. The library updates are probably not because of TOTP itself, the might be required due to the libraries dependencies or framework integrations. Furthermore, if TOTP is implemented, why not add WebAuthn/Passkeys too?

[tandemblog@social.kobelnet.be]

@fbinin @hrafnagud @panda @homelab Furthermore I like to manage my credentials and MFA settings in one place instead of in multiple applications. My services a home grew to the point I already have 14 applications using Keycloak as OTP service. Additionally a Single Sign On requires less support for family members. (I'm aware not every one wants to operate so many applications)

[preya@mastodon.social]

@panda @homelab Yeah this is one of the only major flaws of Immich. It just makes no sense. Here’s a service that needs external access to work properly - yet you can’t secure it with MFA (only when using an external IdP).

[abulling@fedifreu.de]

@preya @panda @homelab The most severe major flaw in #immich IMO is that they don't support proper shared albums. For whatever reason.

[panda@pandas.social]

@tandemblog

I initially implemented multiple login methods in my applications by using existing libraries

I'd really just need one TOTP slot. No WebAuthn, Passkeys or whatever. Just a single means of 2FA.

OAuth / OIDC is great. 100%. I just think it's not a good idea to provide a login with username + password, but then not provide TOTP.

Just remove user+pass auth entirely and rely solely on OAuth/OIDC, if user+pass cannot be secured with TOTP / what ever.

@hrafnagud @homelab

[goebelmeier@hachyderm.io]

@panda @tandemblog @hrafnagud @homelab Exactly, that‘s why i‘m rolling out pocket-id for all my personal services. https://pocket-id.org #pocketid

[panda@pandas.social]

@preya

Exactly! Either remove user+pass entirely and rely solely on oauth/oidc or add a means of 2FA for user+pass.

user+pass is incomplete without 2FA in it's current state.

@homelab

[preya@mastodon.social]

@abulling @panda @homelab What's your specific definition of a "shared folder" in Immich?

[abulling@fedifreu.de]

@preya @panda @homelab I create an album, add some pictures, and can then share it with other users on the same instance. I can set whether they can only view or also edit the album. If so, they can also add pictures etc

I know that there is an "external library" but this is for a different purpose and doesn't provide the functionality of a shared album.

[preya@mastodon.social]

@abulling @panda @homelab This has been a feature for ages. Not sure why you think that's missing. It's even described here in the docs: https://docs.immich.app/features/sharing/

[abulling@fedifreu.de]

@preya @panda @homelab Hm, I wonder as well how I missed this. I had even asked in a forum and people referred to the "external library" function instead. ‍️

Thanks a million!

Do they also support user groups by now (did I miss that as well)?

[abulling@fedifreu.de]

@preya @panda @homelab Ah, right. Now I remember what the issue was (it's been a long time since I last looked into this but my browser history showed what I had been looking into):

https://odd.blog/2026/01/16/creating-a-shared-photo-library-in-immich/

"While Immich has shared albums, they don’t quite solve this problem. The photos don’t appear in search and aren’t processed for face recognition or analysis."

The article proposes a solution based on an external library. That's why I still remembered this "solution"...