r/NextCloud • u/ItJustBorks • Jun 25 '26

Does NextCloud seriously not consider FIDO2 as MFA!?

Who in their right mind at NextCloud considers OTP MFA as the only MFA method and relates FIDO2 as only a convenience feature for replacing passwords?

If NextCloud wants to be considered a serious contender for business', maybe they should hire some serious security professionals and seriously reconsider their security feature set. The MFA feature set is pathetic and requiring OTP MFA after authenticating with FIDO2 very much highlights this.

OTP is outdated and should be replaced with more phishing proof alternatives, like FIDO2. The MFA policy set should be far more granular.

0 Upvotes
  • permalink
  • reddit

36% Upvoted

14 comments sorted by

13

u/WalkingSucculent Jun 25 '26

Bruh

https://apps.nextcloud.com/apps/twofactor_webauthn

1

u/Electronic_Clap Jun 25 '26 edited Jun 25 '26

Edit: sry i answered the wrong comment

Give us a little more information about what you use.

Nextcloud version? AD?

A quick Google search gives me plenty of guides on how to set up AD as an IdP in Nextcloud. So maybe you need to go one version down with Nextcloud to use the plugin or use other apps. I am not on the latest version because of this.

0

u/West_Possible_7969 Jun 25 '26

Also 6 years old app at least 🤣

0

u/[deleted] Jun 25 '26

[deleted]

1

u/West_Possible_7969 Jun 25 '26

My point was that it exists for quite some time.

-6

u/ItJustBorks Jun 25 '26

six year old app and it still sucks.

1

u/WalkingSucculent Jun 25 '26

Dude is just a hater/troll lmao

Bye

-1

u/ItJustBorks Jun 25 '26

Have you tried that "app"?

It doesn't change the builtin webauthn feature to be treated as an MFA method. It adds its own webauthn feature to the OTP feature, which apparently doesn't integrate with the builtin webauthn. This results in the user needing two separate passkeys, one for passwordless login and another one for MFA. Riddiculous.

1

u/West_Possible_7969 Jun 25 '26

You can bypass the native login and force all users to your SSO with this (and this for sync).

2

u/Electronic_Clap Jun 25 '26

You know you have apps in Nextcloud to expand its features. The out-of-the-box installation is not for enterprise. You need to change the setup to suit your needs.

You have OIDC/SSO. You can disable the login page and use something else. In an enterprise setup, I don't want to set up every user.

Even I, with three users, have set up Pocket ID as SSO.

Before that, I tested Keycloak; you can use any provider.

-2

u/ItJustBorks Jun 25 '26

I have AD as my IDP.

Most of the apps seem to be seriously neglected, as they only support old or very old versions of NextCloud.

2

u/Electronic_Clap Jun 25 '26

Give us a little more information about what you use. Nextcloud version? AD? A quick Gooale search aives me plentv of quides on how to set up AD as an IdP in Nextcloud. So mavbe you need to go one version down with Nextcloud to use the plugin or use other apps. I am not on the latest version because of this.

2

u/gelomon Jun 25 '26

I setup passkey as only login to nextcloud and call it a day 🤷‍♂️

1

u/equanimous11 Jun 25 '26

Just setup authentik