Security - Revision history

Regify: /* 2FA */

2026-02-18T10:52:50Z

2FA

Regify: /* 2FA */

2026-02-18T10:44:01Z

2FA

Regify: /* How about individual initial password? */

2026-02-18T10:34:30Z

How about individual initial password?

Regify: /* 2FA */

2026-02-18T10:28:26Z

2FA

Regify: /* Why is there no 2FA? */

2026-02-18T10:22:09Z

Why is there no 2FA?

Regify: /* Why is there no 2FA? */

2026-02-18T10:02:56Z

Why is there no 2FA?

Regify: /* Why is there no 2FA? */

2026-02-18T09:59:09Z

Why is there no 2FA?

Regify: /* Why is there no 2FA? */

2026-02-18T09:57:51Z

Why is there no 2FA?

Regify: /* Why is there no 2FA? */

2026-02-18T09:56:32Z

Why is there no 2FA?

Regify: /* Why is there no 2FA? */

2026-02-18T09:53:12Z

Why is there no 2FA?

@@ Line 44: / Line 44: @@
 Therefore, only ''TOTP'' solutions with ''Authenticator apps'' remain. In our experience, many users are either annoyed by this or unwilling or unable to use Authenticator apps (e.g. because they don't have a mobile or the necessary technical ability). Our solutions, especially regipay, are apps for everyone and not just for people who are used to IT.
-For this reason, we currently do not offer 2FA. However, if you are interested in 2FA, please contact our sales team at sales[at]regify.com to discuss options for integrating 2FA for your company or organisation.
+For this reason, we currently only offer partial 2FA. For ''regimail professional'' users (paying regimail users), they can use a mobile number and SMS for signing up. This is then also required for any password resets. By this, a hijacked email account is not sufficient for a regify account password reset.
 '''NOTE:''' Please note that most regipay and regimail client apps offer optional local protection using a user-defined app password. This is not a replacement for 2FA but offers additional security. If entered, it is asked for whenever the app is used to open a regipay payslip or a regimail and protects against abuse on lost or shared devices.

@@ Line 40: / Line 40: @@
 Most of our customers are unwilling to pay for ''text messages (SMS)'', ''voice calls'' or ''hardware tokens''. Also, it is difficult to estimate the cost because around 30% of users cannot remember or note their regify account password and need to reset it every month. This would require a significant number of SMS messages or calls. Prices for hardware tokens (OTP) are also usually too high.
-Finally, ''biometrics'' are usually only available on mobile devices, not on PC, Linux or MacOS. Desktop users are either not used to it or lack the technical ability to implement it.
+Finally, ''biometrics'' are usually only available on mobile devices, not on Desktop PCs with Windows, Linux or MacOS. Desktop users are either not used to it or lack the technical ability to implement it.
 Therefore, only ''TOTP'' solutions with ''Authenticator apps'' remain. In our experience, many users are either annoyed by this or unwilling or unable to use Authenticator apps (e.g. because they don't have a mobile or the necessary technical ability). Our solutions, especially regipay, are apps for everyone and not just for people who are used to IT.

@@ Line 8: / Line 8: @@
 ## We are providing a security related service. It is not a forum or something where someone might steal some money (which is in most cases insured). People trust that messages sent by regify are very secure and especially for authenticated users we need to make sure that this is always the case.
 ## Knowing the account credentials of some regify account gives an attacker the ability to open all RGF files that have been sent to the victim (if the attacker gets access to them). It also allows him to send in the name of the victim.
-## Even if an account was abused because of a weak password, the press will write that some regify account has been "hacked" (which is wrong, but many journalists do not understand). From the perspective of the public regify now is insecure.
+## Even if an account was abused because of a weak password, the press will write that some regify account has been "hacked" (which is wrong, but many journalists do not understand). From the perspective of the public, regify now is insecure.
 # Therefore, this are the detailed reasons we do not allow people to chose their initial password:
 ## If we allow more or less everything, we will get passwords like "password", "12345678" or "letmein". We all agree that this is not good.

@@ Line 36: / Line 36: @@
 We're occasionally asked about 2FA (two-factor authentication) in regify products. Please read this chapter to understand the facts.
-Opening a payslip in ''regipay Classic'', a ''regimail message'' or a ''regibox invitation'', requires the user to have both regify credentials and the email containing the rgf file. Therefore, sending 2FA confirmation emails is not an option because '''hijacking an email account is the only vulnerability we're talking about'''.
+Opening a payslip in ''regipay Classic'', a ''regimail message'' or a ''regibox invitation'', requires the user to have both regify credentials and the email containing the rgf file. Therefore, sending 2FA confirmation emails is not an option because '''hijacking an email account is the only vulnerability we're talking about'''. Loosing the regify account password (e.g. by phishing) is not sufficient to allow someone to read ''regipay Classic'' or ''regimail'' messages.
-Most of our customers are unwilling to pay for ''text messages (SMS)'', ''voice calls'' or ''hardware tokens''. Also, it is difficult to estimate the cost because around 30% of users cannot remember their password and need to reset it every month. This would require a significant number of SMS messages or calls. Prices for hardware tokens are also usually too high.
+Most of our customers are unwilling to pay for ''text messages (SMS)'', ''voice calls'' or ''hardware tokens''. Also, it is difficult to estimate the cost because around 30% of users cannot remember or note their regify account password and need to reset it every month. This would require a significant number of SMS messages or calls. Prices for hardware tokens (OTP) are also usually too high.
-Finally, ''biometrics'' are usually only available on mobile devices, not on PC, Linux or MacOS. Users are either not used to it or lack the technical ability to implement it.
+Finally, ''biometrics'' are usually only available on mobile devices, not on PC, Linux or MacOS. Desktop users are either not used to it or lack the technical ability to implement it.
 Therefore, only ''TOTP'' solutions with ''Authenticator apps'' remain. In our experience, many users are either annoyed by this or unwilling or unable to use Authenticator apps (e.g. because they don't have a mobile or the necessary technical ability). Our solutions, especially regipay, are apps for everyone and not just for people who are used to IT.

@@ Line 32: / Line 32: @@
 There is no such function in the regify provider. We follow the current guides of NIST (US), CESG (UK) and BSI (DE). Due to research and security experts consent, forcing users to change their password does not increase security. Instead, it very often reduces security because people tend to use more simple passwords and also follow some predictable evolution (like password1, password2, password3 etc.). Password changes are only needed in case the password is compromised in some way.
-==Why is there no 2FA?==
+== 2FA ==
-# Opening a payslip in regipay ''Classic'' requires the reader to have both the regify credentials and the email with the rgf file.
+We're occasionally asked about 2FA (two-factor authentication) in regify products. Please read this chapter to understand the facts.
-Please note that most regipay and regimail client apps offer optional local protection using a ''user defined app password''. If entered, it is asked whenever the app is used to open a regipay payslip and protects against abuse on lost or shared devices. It does not replace 2FA but offers additional security.
+Opening a payslip in ''regipay Classic'', a ''regimail message'' or a ''regibox invitation'', requires the user to have both regify credentials and the email containing the rgf file. Therefore, sending 2FA confirmation emails is not an option because '''hijacking an email account is the only vulnerability we're talking about'''.
 [[File:AppPassword client.png|500px|regify app password dialog]]

@@ Line 35: / Line 35: @@
 # Opening a payslip in regipay ''Classic'' requires the reader to have both the regify credentials and the email with the rgf file.
-# Therefore, sending confirmation emails does not work because a hijacked email account is the only vulnerability we're talking about.
+# Therefore, sending confirmation emails does not work because '''a hijacked email account is the only vulnerability we're talking about'''.
 # Most of our customers are not willing to pay for text messages (SMS), voice calls or even hardware tokens.
 # Biometrics is usually not available on PC, Linux and MacOS clients and users are either not used to it or have no technical ability to implement.

@@ Line 40: / Line 40: @@
 # Now, only TOTP solutions with Authenticator apps are left. To our experience, many users are either annoyed by such, not willing to use Authenticator apps or even unable to use (no mobile, no technical ability).
-Please note that most regipay and regimail client apps offer optional local protection using a ''user defined app password''. If entered, it is asked whenever the app is used to open a regipay payslip and protects against abuse on lost or shared devices. It does not replace 2FA but offers additional security.[[File:AppPassword client.png|right|middle|thumb|regify app password dialog]]
+Please note that most regipay and regimail client apps offer optional local protection using a ''user defined app password''. If entered, it is asked whenever the app is used to open a regipay payslip and protects against abuse on lost or shared devices. It does not replace 2FA but offers additional security.
 ==Security and cryptography==