At Tutanota we are committed to developing the most secure mail service to protect everybody's universal right to privacy. Our built-in end-to-end encryption makes sure that only you with your password can decrypt your mailbox. And while we already make sure that it is close to impossible to get access to your password via brute-force attacks, a minor risk that someone steals your password, e.g. by installing a keylogger on your device, remains. This is where two-factor authentication comes in.
Two-factor authentication immensely increases the security of your account by requiring something you have (e.g. a hardware token) in addition to something you know (e.g. your password) to allow you to login to your secure mail account. Because Tutanota users know how important maximum security is, 2FA-support is also one of the most voted-for features by our community.
Our developers and cryptography professionals have carefully reviewed and tested lots of methods for two-factor authentication. The most secure option for 2FA is U2F, which the Tutanota beta client now supports (see comparison below). It is also the most convenient one as you can simply plugin the U2F device to login to your account without the necessity of entering codes manually.
U2F is an open authentication standard that strengthens and simplifies two-factor authentication using specialized USB or NFC devices.
The private key that allows access to your account is stored locally on this device. When you plugin the 2FA-device, the authentication request is sent to the server that allows you to login to your account.
Chrome and Opera are currently the only browsers supporting U2F natively. Mozilla is integrating U2F support into one of the next versions of Firefox.
Even though, we and the security community, consider U2F as the most secure option, support for other options (TOTP) is also planned.
Read also our guide on how to prevent email phishing attacks.
The authentication system of our secure Tutanota beta client now supports the FIDO Universal 2nd Factor (U2F) standard - the most secure form of 2FA recommended by cryptography professionals and the security community worldwide.
U2F is built to protect against phishing and man-in-the-middle attacks, allowing one U2F device to access any number of services without any shared secrets. In order to take advantage of the security improvements provided by U2F, you will need to buy a hardware key. Any key supporting the U2F standard should work with Tutanota.
At Tutanota we protect our encrypted mail accounts now with a U2F compatible Nitrokey or YubiKey. Right now we are in the final stages of testing our new authentication process as well as many more features in our brand-new beta client. We are excited that we will be able to release our new client as public beta to all our users in September.
If you have missed the private beta invite that we have sent via our social media channels, simply follow us on Twitter, Facebook, Instagram, Google+ and Reddit. Next time we send out invites, you will be able to take part in this exciting development stage.
With this release we have also added session handling. You can now check in Settings of your secure mailbox what devices (e.g. computer, phone) are running an active session of Tutanota. With this new feature you can close a session remotely. If, for instance, you lose your mobile phone and you are logged into your Tutanota mailbox with our apps, you can then login on any computer and close the session on your phone remotely. This way no one will be able to see your mailbox, even if they manage to unlock your phone.
Tutanota is a project to reclaim our right to privacy online. A project to protect our private communication from mass surveillance and illegal wiretapping. The support of our constantly growing user base is incredible and enables us to develop the most secure email service.
We are an independent and small team that fights for privacy and freedom. Tutanota is a big job because we are building the Internet of the future - where everything is encrypted by default.
No comments available