I can’t answer any questions related to Pro because I don’t work for Ghost! Your best bet is to email them via email@example.com
Already voted because yes, the implementation of MFA in the authentication process would be a significant benefit for security, and I hope one day it will.
It’s exactly the same, Ghost(Pro) doesn’t have any customisations of Ghost. If 2fa is implemented it would need to be in Ghost core and work for self-hosters.
Any update here?
Id be happy with just a 2fa via u2f on ghost pro accounts for a short term solution
I"d be happy to help code some of this. Obviously its a big chunk of work and I don’t want a big PR to get denied per the GitHub guidance:
We generally don’t merge new features and larger changes without prior discussion with the core product team for tech/design specification.
Was really surprised to see no support for MFA on Ghost(Pro). It’s 2022 and this is such an important security feature. I have MFA turned on on all of the services that support my site (DNS, analytics, blog commenting, etc.). The only account that does not require a sector factor is Ghost itself!!
Can we please get 2FA for staff accounts implemented via an authentication app such as the one built into Apple device password store or an app like Authy? The passwordless system for members to log in is excellent, but the email/password combination for staff members is highly outdated and lacks modern security features.
We desperately need 2FA capability for staff accounts.
2FA should really be mandatory for all staff accounts.
Why is this still not implemented? It’s been 5 years since it was first suggested. We’re handling people’s private personal and payments data.
EDIT: so this comment was apparently close to violating the Code of Conduct. I have been told I should make “suggestions with sources”, so here we go.
Clearly MFA is necessary. I don’t have to explain why. If the Devs didn’t want to implement it 5 years ago because there was no open source implementation available (totally understandable) there are now.
I found PrivacyIDEA, an open source and apparently free MFA project. It supports many forms of authentication, including HOTP / TOTP (One Time Passwords), email tokens, SMS (nobody should use this but it’s there), WebAuthn, U2F, Password Tokens, Yubikeys and NitroKeys, and more. When I have got a stable build of my website I’ll be attempting to implement OTPs and Yubikey auth, I’ll let you know how it goes.
Alternatively, there is Ory, which offers the same range of open source auth solutions to build on your site and a hosted service if you don’t want to host it yourself (it’s about $30 for 1000 users a month).
@kerryhatcher I know it’s been 3 years but do you still want to help? Does anyone else want to try implement some of these and see how they work? I’m not very experienced with Node.js (Python for me!) so my progress will probably be quite slow. If anyone wants to help, I would appreciate it. I think everyone here needs the security and if we can get a workable, open source solution running, the devs can add it to Ghost and keep everyone safe.
Let me know what you think and if you want to help. Cheers.
Is that a real limitation to implementing some MFA that’s mandatory for every project that supposed to be secure on internet?
Are you still thinking on that on 2023? I can live without SSO (because there are devs around there) and I can bought a theme (two really).
But I can’t open to the world my collaborative projects without MFA.
We will be hopeful.
I would really like to secure my newsletter login with 2FA. Many hacks nowadays are stopped by such mechanisms.
I would like to see Passkeys implemented.
Is there any update or official update from Ghost in regards to if 2FA/MFA feature is being worked on?
I know there is already a thread, but wanted to express that MFA should be without question the top priority for new features. No plugins – MFA built in to the product like any other app. I cannot even think of a single other app I use that doesn’t have MFA. I love Ghost but this really confuses me how this could be left out of development.
Also, it definitely costs Ghost money to not have MFA. I know several businesses that will not use Ghost simply because no MFA. I work in cybersecurity and MFA really isn’t optional in 2023. Businesses running ghost have compliance needs/etc and not having MFA on a production website looks bad + is insecure.
Also, why no option to whitelist IPs that can login? A basic feature like this is literally an if statement comparing against a CIDR list of IP – guessing max time to implement 48 hours…
Having IP whitelist is a good option that is better than nothing until MFA is added.
In short: the cost to develop is low (low effort/low cost), and money lost from businesses not buying b/c no MFA is likely high.
We need this feature. Anti-bruteforce protection can only go to far and 2FA is designed to be a combination of something you know(which can be prone to phisihing and stuff) and something you have which tends to be less prone to phishing and increases security and is standard is most businesses.
Any updates here? …also voting 2FA up! This is an essential feature that’s missing.