Security in
summary
Nextcloud adds default brute-force detection that throttles repeated bad logins per subnet up to ~30 seconds, reducing online guessing without user setup. Built-in second-factor (TOTP and hardware/U2F options) prompts after password entry and blocks access if missing. Application-specific passwords let mobile clients bypass 2FA, can be individually revoked, and survive most session flows so changing the main password invalidates normal clients but not declared app passwords. SameSite cookie flags limit cross-site request cookie leakage in Chrome and Opera.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:23Bruteforce protection for logins
- 1:05Two-Factor Authentication
- 1:59Same Site Cookies
- 2:37Application specific passwords
- 3:28Kill existing sessions
- 3:39Changing passwords revokes active sessions
related talks
04mNextcloud s Two Factor Authentication
47mThe Psychology of Multi-Factor Authentication
27mAccount Security for the Fashionable App Developer
32mPasswords are so 1990
30mhunter2: A Symphony of Password Horror
21mFortify the Fort: Think outside the security
44m(in)Security is eating the world
18mEffective password management