Email-based TOTP login method, now generally available!

Hi Muhib - Thanks for your feedback. The launch of TOTP will not affect the existing password-based login fallback option. In the future, as we move towards deprecating password-based login, we plan to transition from a password-based to an email-based TOTP fallback mechanism.

Hi @HTQIHC, @jbquotient, and @BYoung - We truly appreciate your feedback. Please know that our Product and Engineering teams are taking a thoughtful and gradual approach to enhancing login security. Our foremost concern is ensuring that our customers have a more secure login experience than the traditional password based login, which is why we're initially implementing an email-based TOTP option. Rest assured, we're actively exploring additional MFA options, and we may incorporate them into our roadmap as we move forward. That said, I have shared your feedback with our Product and Engineering teams for their consideration.

Hi @TJohnson - Thank you for taking the time to share your thoughts and concerns with us. We truly value the feedback from our user community, especially as it pertains to significant changes like password deprecation. I want to assure you that we have not yet finalized the exact date for deprecating the password based login. Your input, along with that from others in our community, is crucial as we navigate these changes and consider the best path forward.

We understand the importance of balancing security enhancements with usability and the impact such changes can have on diverse workflows, particularly in settings like yours where unique email setups are in place. Our goal is not to disrupt but to enhance and secure the way you work with Smartsheet.

Please know that we are actively exploring additional authentication options, including the use of authenticator apps, to provide a more flexible and user-friendly security approach. Your specific concerns, particularly about the potential impact on your team and the need for adaptable solutions, are being taken into consideration as we plan the next steps.

Hi @DPerry - There is no change to current session validation duration. It will remain as it is today. Smartsheet login session validity does not vary by login method.

@Michael Chohrach - Thanks for your feedback. The launch of TOTP will not affect the existing password-based login fallback option. In the future, as we move towards deprecating password-based login, we plan to transition from a password-based to an email-based TOTP fallback mechanism.

Hi @Dan Britton - We are following up with the Product and Engineering teams about this. In the meantime, if you have any further details you can share, that would be very helpful.

Hi Stefan-

1. Regarding SysAdmin fallback login: The launch of TOTP will not affect the existing password-based login fallback option. In the future, as we move towards deprecating password-based login, we plan to transition from a password-based to an email-based TOTP fallback mechanism.
2. Why we're not supporting FIDO/U2F at the moment: Our Product and Engineering teams are taking a thoughtful and gradual approach to enhancing login security. Our foremost concern is ensuring that our customers have a more secure login experience than the traditional password based login, which is why we're initially implementing an email-based TOTP option. Rest assured, we're actively exploring additional MFA options, and we may incorporate them into our roadmap as we move forward.
3. Regarding accounts used for API connections: This change will only impact logins through the user interface (UI) and will not influence API login tokens. After we deprecate password based login in future, any accounts used to generate login tokens will need to use alternative login methods, other than passwords, via the web to create new API tokens.