Before today, mailbox.org’s 2FA mechanism was unorthodox. In the login screen, you typed in the TOTP in the password field and then added a 4 digit static pin at the end. This got people confused, as it’s different than the usual login+password then TOTP. Now it’s just like that.
There’s also other goodies, like separate passwords for IMAP and SMTP, WebDAV, CardDAV/CalDAV (one password for both), Exchange Sync. Before today, you’d be using your main mailbox.org password for all of the above. Looks like IMAP access is not even possible without creating a separate password https://kb.mailbox.org/en/private/account-article/how-to-use-two-factor-authentication-2fa/
There doesn’t seem to be support for the YubiKey TOTP anymore. No passkeys or hardware webauthn either for now.
mailbox.org is based on OpenXchange.
Okay, so for those of us using third party apps like Thunderbird, everything is done using app specific passwords, which is great
But if this is a new feature, how did third party apps work before? Could people just not use them if they enabled 2FA?
Basically, yes, they couldn’t use them. The old 2FA had a really weird implementation…
This is just wrong, you used the main account password instead of an app password