Security - Revision history

Regify: /* How do I force users to change passwords periodically? */

2026-08-04T06:44:32Z

How do I force users to change passwords periodically?

Regify: /* Security and cryptography */

2026-08-03T13:52:42Z

Security and cryptography

Regify: /* Passwords */

2026-08-03T13:48:43Z

Passwords

Regify: /* 2FA */

2026-02-18T10:52:50Z

2FA

Regify: /* 2FA */

2026-02-18T10:44:01Z

2FA

Regify: /* How about individual initial password? */

2026-02-18T10:34:30Z

How about individual initial password?

Regify: /* 2FA */

2026-02-18T10:28:26Z

2FA

Regify: /* Why is there no 2FA? */

2026-02-18T10:22:09Z

Why is there no 2FA?

Regify: /* Why is there no 2FA? */

2026-02-18T10:02:56Z

Why is there no 2FA?

Regify: /* Why is there no 2FA? */

2026-02-18T09:59:09Z

Why is there no 2FA?

@@ Line 33: / Line 33: @@
 ===How do I force users to change passwords periodically?===
-There is no such function in the regify provider. We follow the current guides of NIST (US), CESG (UK) and BSI (DE). Due to research and security experts consent, forcing users to change their password does not increase security. Instead, it very often reduces security because people tend to use more simple passwords and also follow some predictable evolution (like password1, password2, password3 etc.). Password changes are only needed in case the password is compromised in some way.
+There is no such function in the regify provider. We follow the current guides of NIST (US), CESG (UK) and BSI (DE). Due to research and security experts consent, <u>forcing users to change their password does not increase security</u>. Instead, it very often reduces security because people tend to use more simple passwords and also follow some predictable evolution (like password1, password2, password3 etc.). Password changes are only needed in case the password is compromised in some way.
 == 2FA ==

@@ Line 99: / Line 99: @@
 '''Update July 2019:'''<br  />
 [https://latacora.singles/2019/07/16/the-pgp-problem.html The PGP Problem]
 ==Connection protocol==
 You want to know more details about our regify connection protocol? No problem, just send us an email to support(at)regify.com and tell us why you're interested. We will send you the documents then.

@@ Line 25: / Line 25: @@
 We also consider our randomly generated 8 character passwords more secure than any 12 digits user generated password. But anyway, every regify provider is able to increase the number of characters for the initial password by himself.
 ===How are the passwords stored in the regify provider appliance database?===
-Due to technical reasons (like the provider lookup service PLS and cross-provider password reset), we save the SHA1 hashcodes of the passwords. But they are additionally encrypted using AES256 encryption with individual random IV and the SHA256 hashcode of the regify provider clearing password as key. This clearing password is never stored in the database and exists only in a local file outside of the web root. By this, SQL-injection attacks and database leaks are not able to leak passwords directly.
+Due to technical reasons (like the provider lookup service PLS and cross-provider password reset), we save the SHA1 hashcodes of the passwords. But they are additionally encrypted using AES256 encryption with individual random IV and the SHA256 hashcode of the regify provider clearing password as key. This clearing password is never stored in the database and exists only in a local file outside of the web root. By this, SQL-injection attacks and database leaks are not able to leak password hashcodes.
 ===How do I force users to change passwords periodically?===

@@ Line 44: / Line 44: @@
 Therefore, only ''TOTP'' solutions with ''Authenticator apps'' remain. In our experience, many users are either annoyed by this or unwilling or unable to use Authenticator apps (e.g. because they don't have a mobile or the necessary technical ability). Our solutions, especially regipay, are apps for everyone and not just for people who are used to IT.
-For this reason, we currently do not offer 2FA. However, if you are interested in 2FA, please contact our sales team at sales[at]regify.com to discuss options for integrating 2FA for your company or organisation.
+For this reason, we currently only offer partial 2FA. For ''regimail professional'' users (paying regimail users), they can use a mobile number and SMS for signing up. This is then also required for any password resets. By this, a hijacked email account is not sufficient for a regify account password reset.
 '''NOTE:''' Please note that most regipay and regimail client apps offer optional local protection using a user-defined app password. This is not a replacement for 2FA but offers additional security. If entered, it is asked for whenever the app is used to open a regipay payslip or a regimail and protects against abuse on lost or shared devices.

@@ Line 40: / Line 40: @@
 Most of our customers are unwilling to pay for ''text messages (SMS)'', ''voice calls'' or ''hardware tokens''. Also, it is difficult to estimate the cost because around 30% of users cannot remember or note their regify account password and need to reset it every month. This would require a significant number of SMS messages or calls. Prices for hardware tokens (OTP) are also usually too high.
-Finally, ''biometrics'' are usually only available on mobile devices, not on PC, Linux or MacOS. Desktop users are either not used to it or lack the technical ability to implement it.
+Finally, ''biometrics'' are usually only available on mobile devices, not on Desktop PCs with Windows, Linux or MacOS. Desktop users are either not used to it or lack the technical ability to implement it.
 Therefore, only ''TOTP'' solutions with ''Authenticator apps'' remain. In our experience, many users are either annoyed by this or unwilling or unable to use Authenticator apps (e.g. because they don't have a mobile or the necessary technical ability). Our solutions, especially regipay, are apps for everyone and not just for people who are used to IT.

@@ Line 8: / Line 8: @@
 ## We are providing a security related service. It is not a forum or something where someone might steal some money (which is in most cases insured). People trust that messages sent by regify are very secure and especially for authenticated users we need to make sure that this is always the case.
 ## Knowing the account credentials of some regify account gives an attacker the ability to open all RGF files that have been sent to the victim (if the attacker gets access to them). It also allows him to send in the name of the victim.
-## Even if an account was abused because of a weak password, the press will write that some regify account has been "hacked" (which is wrong, but many journalists do not understand). From the perspective of the public regify now is insecure.
+## Even if an account was abused because of a weak password, the press will write that some regify account has been "hacked" (which is wrong, but many journalists do not understand). From the perspective of the public, regify now is insecure.
 # Therefore, this are the detailed reasons we do not allow people to chose their initial password:
 ## If we allow more or less everything, we will get passwords like "password", "12345678" or "letmein". We all agree that this is not good.

@@ Line 36: / Line 36: @@
 We're occasionally asked about 2FA (two-factor authentication) in regify products. Please read this chapter to understand the facts.
-Opening a payslip in ''regipay Classic'', a ''regimail message'' or a ''regibox invitation'', requires the user to have both regify credentials and the email containing the rgf file. Therefore, sending 2FA confirmation emails is not an option because '''hijacking an email account is the only vulnerability we're talking about'''.
+Opening a payslip in ''regipay Classic'', a ''regimail message'' or a ''regibox invitation'', requires the user to have both regify credentials and the email containing the rgf file. Therefore, sending 2FA confirmation emails is not an option because '''hijacking an email account is the only vulnerability we're talking about'''. Loosing the regify account password (e.g. by phishing) is not sufficient to allow someone to read ''regipay Classic'' or ''regimail'' messages.
-Most of our customers are unwilling to pay for ''text messages (SMS)'', ''voice calls'' or ''hardware tokens''. Also, it is difficult to estimate the cost because around 30% of users cannot remember their password and need to reset it every month. This would require a significant number of SMS messages or calls. Prices for hardware tokens are also usually too high.
+Most of our customers are unwilling to pay for ''text messages (SMS)'', ''voice calls'' or ''hardware tokens''. Also, it is difficult to estimate the cost because around 30% of users cannot remember or note their regify account password and need to reset it every month. This would require a significant number of SMS messages or calls. Prices for hardware tokens (OTP) are also usually too high.
-Finally, ''biometrics'' are usually only available on mobile devices, not on PC, Linux or MacOS. Users are either not used to it or lack the technical ability to implement it.
+Finally, ''biometrics'' are usually only available on mobile devices, not on PC, Linux or MacOS. Desktop users are either not used to it or lack the technical ability to implement it.
 Therefore, only ''TOTP'' solutions with ''Authenticator apps'' remain. In our experience, many users are either annoyed by this or unwilling or unable to use Authenticator apps (e.g. because they don't have a mobile or the necessary technical ability). Our solutions, especially regipay, are apps for everyone and not just for people who are used to IT.

@@ Line 32: / Line 32: @@
 There is no such function in the regify provider. We follow the current guides of NIST (US), CESG (UK) and BSI (DE). Due to research and security experts consent, forcing users to change their password does not increase security. Instead, it very often reduces security because people tend to use more simple passwords and also follow some predictable evolution (like password1, password2, password3 etc.). Password changes are only needed in case the password is compromised in some way.
-==Why is there no 2FA?==
+== 2FA ==
-# Opening a payslip in regipay ''Classic'' requires the reader to have both the regify credentials and the email with the rgf file.
+We're occasionally asked about 2FA (two-factor authentication) in regify products. Please read this chapter to understand the facts.
-Please note that most regipay and regimail client apps offer optional local protection using a ''user defined app password''. If entered, it is asked whenever the app is used to open a regipay payslip and protects against abuse on lost or shared devices. It does not replace 2FA but offers additional security.
+Opening a payslip in ''regipay Classic'', a ''regimail message'' or a ''regibox invitation'', requires the user to have both regify credentials and the email containing the rgf file. Therefore, sending 2FA confirmation emails is not an option because '''hijacking an email account is the only vulnerability we're talking about'''.
 [[File:AppPassword client.png|500px|regify app password dialog]]

@@ Line 35: / Line 35: @@
 # Opening a payslip in regipay ''Classic'' requires the reader to have both the regify credentials and the email with the rgf file.
-# Therefore, sending confirmation emails does not work because a hijacked email account is the only vulnerability we're talking about.
+# Therefore, sending confirmation emails does not work because '''a hijacked email account is the only vulnerability we're talking about'''.
 # Most of our customers are not willing to pay for text messages (SMS), voice calls or even hardware tokens.
 # Biometrics is usually not available on PC, Linux and MacOS clients and users are either not used to it or have no technical ability to implement.

@@ Line 40: / Line 40: @@
 # Now, only TOTP solutions with Authenticator apps are left. To our experience, many users are either annoyed by such, not willing to use Authenticator apps or even unable to use (no mobile, no technical ability).
-Please note that most regipay and regimail client apps offer optional local protection using a ''user defined app password''. If entered, it is asked whenever the app is used to open a regipay payslip and protects against abuse on lost or shared devices. It does not replace 2FA but offers additional security.[[File:AppPassword client.png|right|middle|thumb|regify app password dialog]]
+Please note that most regipay and regimail client apps offer optional local protection using a ''user defined app password''. If entered, it is asked whenever the app is used to open a regipay payslip and protects against abuse on lost or shared devices. It does not replace 2FA but offers additional security.
 ==Security and cryptography==