#Immich does not have 2FA and the devs made clear, it's not coming.
-
External solutions provide better authentication and should be preferred.
I do get the point and a line has to be drawn. I just don't share this sentiment entirely, because TOTP e.g. is not that hard to implement.
Sure it's a photo and not a authentication app... but .. you know... it might be preferable to add a means of 2FA for people who don't want to manage an sso provider.
@panda @homelab I'm with you - 2FA shouldn't be that hard to implement considering users who don't want (or can't) implement OAUTH. I use my instance with PocketID so I don't care but from a security point of view you're definitely right here. Implementation shouldn't cost that much resources and would be a secure base for "normal" users of Immich.
-
@panda @homelab I'm with you - 2FA shouldn't be that hard to implement considering users who don't want (or can't) implement OAUTH. I use my instance with PocketID so I don't care but from a security point of view you're definitely right here. Implementation shouldn't cost that much resources and would be a secure base for "normal" users of Immich.
-
External solutions provide better authentication and should be preferred.
I do get the point and a line has to be drawn. I just don't share this sentiment entirely, because TOTP e.g. is not that hard to implement.
Sure it's a photo and not a authentication app... but .. you know... it might be preferable to add a means of 2FA for people who don't want to manage an sso provider.
@panda @hrafnagud @homelab I want state-of-the-art security for all users, but I also understand developers' positions. I initially implemented multiple login methods in my applications by using existing libraries, but this got too hard to keep up to date, especially when I tried to integrate WebAuthn/Passkeys. Therefore, I started using OAUTH and delegated the hard part of different login methods.
My proposal is to make security easy by referring to simple, and easy-to-set-up OAUTH services. -
@panda @hrafnagud @homelab I want state-of-the-art security for all users, but I also understand developers' positions. I initially implemented multiple login methods in my applications by using existing libraries, but this got too hard to keep up to date, especially when I tried to integrate WebAuthn/Passkeys. Therefore, I started using OAUTH and delegated the hard part of different login methods.
My proposal is to make security easy by referring to simple, and easy-to-set-up OAUTH services.@tandemblog @panda @homelab Good point - thanks for sharing your thoughts on that one!
-
@tandemblog @panda @homelab Good point - thanks for sharing your thoughts on that one!
@hrafnagud @tandemblog @panda @homelab
But but, TOTP is much simpler to implement and does not have several changes or does not need many updates. OAUTH can change implementation logic and unless kept updated by the user, it may not work or may lock one out (I guess). These are pics, which are sensitive and have several data which can be parsed. TOTP obviously is not hard to implement.
Also, TOTP can be implemented once, and not updated, it will still work. -
@hrafnagud @tandemblog @panda @homelab
But but, TOTP is much simpler to implement and does not have several changes or does not need many updates. OAUTH can change implementation logic and unless kept updated by the user, it may not work or may lock one out (I guess). These are pics, which are sensitive and have several data which can be parsed. TOTP obviously is not hard to implement.
Also, TOTP can be implemented once, and not updated, it will still work.@fbinin @hrafnagud @panda @homelab But a good TOTP implementation takes some effort too if you want to support multiple devices and recovery codes. The library updates are probably not because of TOTP itself, the might be required due to the libraries dependencies or framework integrations. Furthermore, if TOTP is implemented, why not add WebAuthn/Passkeys too?
-
@hrafnagud @tandemblog @panda @homelab
But but, TOTP is much simpler to implement and does not have several changes or does not need many updates. OAUTH can change implementation logic and unless kept updated by the user, it may not work or may lock one out (I guess). These are pics, which are sensitive and have several data which can be parsed. TOTP obviously is not hard to implement.
Also, TOTP can be implemented once, and not updated, it will still work.@fbinin @hrafnagud @panda @homelab Furthermore I like to manage my credentials and MFA settings in one place instead of in multiple applications. My services a home grew to the point I already have 14 applications using Keycloak as OTP service. Additionally a Single Sign On requires less support for family members. (I'm aware not every one wants to operate so many applications)
-
#Immich does not have 2FA and the devs made clear, it's not coming.
The reasoning against #2FA is pretty weak.
This thread is
️ (for me). Points were made. -
-
@panda @hrafnagud @homelab I want state-of-the-art security for all users, but I also understand developers' positions. I initially implemented multiple login methods in my applications by using existing libraries, but this got too hard to keep up to date, especially when I tried to integrate WebAuthn/Passkeys. Therefore, I started using OAUTH and delegated the hard part of different login methods.
My proposal is to make security easy by referring to simple, and easy-to-set-up OAUTH services.I initially implemented multiple login methods in my applications by using existing libraries
I'd really just need one TOTP slot. No WebAuthn, Passkeys or whatever. Just a single means of 2FA.
OAuth / OIDC is great. 100%. I just think it's not a good idea to provide a login with username + password, but then not provide TOTP.
Just remove user+pass auth entirely and rely solely on OAuth/OIDC, if user+pass cannot be secured with TOTP / what ever.
-
I initially implemented multiple login methods in my applications by using existing libraries
I'd really just need one TOTP slot. No WebAuthn, Passkeys or whatever. Just a single means of 2FA.
OAuth / OIDC is great. 100%. I just think it's not a good idea to provide a login with username + password, but then not provide TOTP.
Just remove user+pass auth entirely and rely solely on OAuth/OIDC, if user+pass cannot be secured with TOTP / what ever.
@panda @tandemblog @hrafnagud @homelab Exactly, that‘s why i‘m rolling out pocket-id for all my personal services. https://pocket-id.org #pocketid
-
-
-
@preya @panda @homelab I create an album, add some pictures, and can then share it with other users on the same instance. I can set whether they can only view or also edit the album. If so, they can also add pictures etc
I know that there is an "external library" but this is for a different purpose and doesn't provide the functionality of a shared album.
-
@preya @panda @homelab I create an album, add some pictures, and can then share it with other users on the same instance. I can set whether they can only view or also edit the album. If so, they can also add pictures etc
I know that there is an "external library" but this is for a different purpose and doesn't provide the functionality of a shared album.
@abulling @panda @homelab This has been a feature for ages. Not sure why you think that's missing. It's even described here in the docs: https://docs.immich.app/features/sharing/
-
@abulling @panda @homelab This has been a feature for ages. Not sure why you think that's missing. It's even described here in the docs: https://docs.immich.app/features/sharing/
-
@preya @panda @homelab Ah, right. Now I remember what the issue was (it's been a long time since I last looked into this but my browser history showed what I had been looking into):
https://odd.blog/2026/01/16/creating-a-shared-photo-library-in-immich/
"While Immich has shared albums, they don’t quite solve this problem. The photos don’t appear in search and aren’t processed for face recognition or analysis."
The article proposes a solution based on an external library. That's why I still remembered this "solution"...
-
@fbinin @hrafnagud @panda @homelab But a good TOTP implementation takes some effort too if you want to support multiple devices and recovery codes. The library updates are probably not because of TOTP itself, the might be required due to the libraries dependencies or framework integrations. Furthermore, if TOTP is implemented, why not add WebAuthn/Passkeys too?
@tandemblog @hrafnagud @panda @homelab
1 at a time tbvh.
I mean TOTP first, so that at least the basic need is implemented. Rest can come at a later stage if possible. The more ask gets chipped, the more the word NO gets chanted by the devs.I do understand it all can be done. It also begs the question of a maintainer. Even smaller changes or updates at times may break something. One reason why I said, just implement the basis TOTP at least.
-
@fbinin @hrafnagud @panda @homelab Furthermore I like to manage my credentials and MFA settings in one place instead of in multiple applications. My services a home grew to the point I already have 14 applications using Keycloak as OTP service. Additionally a Single Sign On requires less support for family members. (I'm aware not every one wants to operate so many applications)
@tandemblog @hrafnagud @panda @homelab
Very true. Not everyone likes to have so many things. I have 40+ TOTPs myself. -
@preya @panda @homelab Ah, right. Now I remember what the issue was (it's been a long time since I last looked into this but my browser history showed what I had been looking into):
https://odd.blog/2026/01/16/creating-a-shared-photo-library-in-immich/
"While Immich has shared albums, they don’t quite solve this problem. The photos don’t appear in search and aren’t processed for face recognition or analysis."
The article proposes a solution based on an external library. That's why I still remembered this "solution"...
️ 
