Security: Two-factor authentication when accessing your database from a new device
Pinned Completed
Submitted by user Tony Appleton:
"How about 2-factor authentication (2FA)? My thoughts are that the ideal would be with hardware such as a Yubikeys and a fall-back to either SMS code or registered code-generator (Symantec's VIP access or Google Authenticator perhaps)."
-
Official comment
Hi Dan,
Thank you for providing your feedback.
We understand that two-step authentication might not be for everyone, especially when sharing computer etc...
As part of our complete security improvement, we have also released IP Address restriction which have the following capability:
Restrict user login based on User's Location. Great alternative to two-step authentication on shared computer.- Set static internet address for your location to restrict user login within clinic network only.
- Set static internet address for user home to restrict user login within home network only.
- Create your own private network to ensure sensitive patient information can only be accessed at approved locations only.
We do have plan to use Google or Microsoft Auth app in the future. We are looking for feedback and interest before prioritise accordingly.
Comment actions -
Hi Tony,
Thanks for submitting a feature request! Once again, this is a great idea and would definitely beef up our security. We are well aware of the benefits of two-factor authentication, and thus we already have it logged in our project management system. We have scheduled it to be released in one of our next few updates, so keep an eye out on this Feature Request page for our official comment! Thanks again!
-
Congrats on getting the 2FA up and running. Could we please have other ways to obtain the 2FA key other then sms to mobile. Maybe a few alternate options such as email or Google Authenticator? The reason I ask is that our team have quite a few generic users that don't share the same mobile.
Please sign in to leave a comment.
Comments
3 comments