From c5bcb5326ff331ccbf886f0c1b1d317f7e439ce3 Mon Sep 17 00:00:00 2001 From: Andris Reinman Date: Mon, 7 Aug 2017 16:45:53 +0300 Subject: [PATCH] Updated Security implementation (markdown) --- Security-implementation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Security-implementation.md b/Security-implementation.md index 5310f0b..d1f6f59 100644 --- a/Security-implementation.md +++ b/Security-implementation.md @@ -4,7 +4,7 @@ User password is hashed with bcrypt, using 12 rounds. Password is stored in the ## 2FA -Wild Duck generates TOTP seed tokens. These are encrypted (aes192) on storage with an application configured master password. Encrypted TOTP seed is stored in the user entry in the users database. +Wild Duck generates random TOTP seed tokens. These are encrypted (aes192) on storage with an application configured master password. Encrypted TOTP seed is stored in the user entry in the users database. If 2FA is enabled then account password can only be used for the "master" scope but not for IMAP, POP3 or SMTP. In these cases the user must generate an Application Specific Password for the required scope(s).