Implemented 3CX Multi-Factor Authentication

[tsi3]

When will 3CX enable Multi-Factor Authentication or One-Time Passwords for either the Web Portal and/or Soft-Phone Registration?

 

[James Bartrop]

+1 With option to SMS or use an authenticator app.

 

[cobaltit]

+1 With option to SMS or use an authenticator app.

There won't be any SMS. For one, SMS is not considered secure and for two, 3CX won't want to absorb the associated cost.

 

[Richard Pettigrew]

Please also consider adding support for Microsoft MFA - the app on the phone is great and support non-ms acocunts too.

 

[snowmethod]

+1 for all of the above

 

[DTI Tech]

+1 for MFA.
This is no longer optional given the current security climate.

 

[nowonder]

+1

 

[Walter Santos]

It could work with any other system via SAML.

 

[UnDutchable30]

3CX team: can you please provide a response as from security perspective doing nothing is not acceptable at all. Right now your login is not secure for such a critical communication system.

 

[HumanDigital]

+1 -> 2FA would let me sleep better at night as an admin

 

[Haertsch.ch GmbH]

+1

 

[networks365]

+1 vote

 

[mcaponong]

You could also allow multiple administrators and implement SQRL. It works great and is easy. https://www.grc.com/sqrl/sqrl.htm

 

[SEGuy]

+1 - this has been a request since 2017 in multiple threads. I think it's the kind of thing that shouldn't take >3 years to implement on a roadmap when dozens and dozens of users have requested it. I understand "everyone wants everything" - but 2FA is on most SIP providers now, along with toll-fraud protections.

I don't think it's unreasonable to build a basic Authy/Google Authenticator/Duo setup since all the tools now have complete, documented APIs. SMS is actually "more work" likely, due to the complexity of telco integration and troubleshooting/configuration.

Honestly, this is low-hanging fruit in my opinion. Sorry, but it is.

 

[Cornelius Schoeman]

+1

 

[priority7]

+1

 

[Fredy Martínez Cubillos]

+1

 

[dsi-infologic]

+1

 

[alainarnold]

+1

 

[edfosho]

It's clear this is needed... how come it isn't marked as 'In Consideration' yet?

(apologies if it is elsewhere)

 

[air3]

+1