Thank you for the feedback Pamalam. I never thought of using the Apple Watch for some type of MFA, so we'll have to look into whether that would work or not. For some, if it's possible, that my be all they would want for extra security. Regarding push and sms methods, we plan on using Authy since it is more flexible and easier to manage for the user. The Google authenticator makes it difficult to move to other devices and nearly impossible, if not actually impossible, to restore or sync MFA keys. For some, that's a good representation of security, but for most it goes too far and is difficult to use.

Thank you very much for your feedback Jonathan. We do have 2FA support on our radar, and we plan to implement it in future releases of v6. It won't be implemented for 6.0, but we plan for it to be a significant feature to be added in a 6.x release.

Thank you for your feedback @Philipp. We do have this on our radar to be implemented in mSecure 6. It won't be available in the first release, but it will be added as soon as possible to a following v6 release. It's one of the priority features on our list.

@Jaysan Yubikey support is on our product roadmap, but it was never scheduled to be supported in the first release of v6: https://www.msecure.com/roadmap-of-upcoming-features-in-msecure/

It's difficult for me to respond to your other comments, because I'm obviously biased towards our company. We are moving to a much smaller release window now that we have moved to our current model, but we obviously have no track record yet to point to, since v6 is so new. Hopefully that makes sense, and if you have any other questions, please do let me know.

Hi Everyone,

I wanted to give you all an update on plans for 2FA/MFA and Yubikey support. While we have got a lot of good feedback from many customers, we're still looking to get more as we continue to look into implementing this feature. And unfortunately, we have run into a snag as we began the development. I can't get into details, but Yubikey support for Mac is very tricky. Support for iOS seems very straight-forward, but that's the platform that almost always has added security via Face/Touch ID, so it's not where this feature is needed most. However, we're still working on the feature, and we're hoping to get some more specific feedback from our customers on how our customers would like to use it.

First, we need to go over platform support. iOS support looks pretty straight-forward, but as mentioned above, Mac support is tricky. Windows and Android support is in the mix as well, but we have only begun the process of researching for iOS and Mac at this point. If Yubikey support were only available for iOS, would it be worth it? I know @Rob would use it for iOS, but if I'm understanding the feedback thus far, Face and Touch ID support make the iOS mSecure app more than safe enough. Any other thoughts for only having iOS support?

Second, we have three different ways in which MFA can be applied:

1. When signing in to your account either on a new device or after reinstalling/resetting the mSecure app on any device.
2. When unlocking or logging in to the app. What I mean here is after you have set up the app, you only need to enter your password to open mSecure and view your information. This is when you would use Face/Touch ID instead of entering your password.
3. When viewing the details or editing a record.

One and two are pretty much mandatory when it comes to an MFA implementation. They are the most obvious contexts in which you would need to authenticate with a 2nd factor in order to proceed. However, we're not sure if the third option is something our customers would user or not. As an example of the workflow, I would think #1 and #3 would be a good combination. In order to even set up mSecure on any device, you would have to know your Username, your mSecure account Password, your Encrypted Account Key in the form of a QR code (even when retrieved from your iCloud Drive account, it's still used for authentication), and you would have to authenticate with the Yubikey. For signing in to your account, the Encrypted Account Key has always been a form of 2FA, because without that key, even if someone knows your Username and Password, they cannot get access to your account. So with the Yubikey, you would actually have 3 factors of authentication. Then after you are signed in, you could set different records to require authentication via the Yubikey. This way, you could more easily unlock mSecure, but then if you needed to look at the details for a certain record, after you tapped it, you would have to authenticate with the Yubikey in order to view the details.

All three options would be implemented if all of them were found valuable. I'm not entirely sure about this, but I believe all three would be optional. You could pick and choose which ones to enable, and if you wanted all three enabled to really lock things down, you could do it. In that case, you'd have to use the Yubikey when you first signed in to your account, then every time you unlocked the app, even if you also used Face/Touch ID, then again when you tapped a record to view its details.

Third, I may know the answer to this one already, but how do you see Yubikey, or any hardware key, helping that much more than biometric unlock features? In theory, the answer is obvious. There's no question that another factor of authentication is more secure. However, in practice, do you believe it to be a lot more secure than the biometrics offered on most devices? For example, if you had a computer that offered biometrics that mSecure tied into, would you find it necessary to enable MFA?

Thank you all for your feedback in advance. We know that MFA is very important to a lot of our customers, and we want to do it right.