The MFA Gap: Why Consistent Two-Factor Coverage Is Harder Across a Suite Than It Looks
Two-factor authentication exists today in exactly 2 of Piskes's 17 apps. That's a real, specific state, not a completed rollout — and it's worth explaining why suite-wide MFA is harder to achieve than adding it to one app.
Adding two-factor authentication to one app is a well-understood, largely solved problem. Making it consistent across a suite of 17 apps that didn't all start with the same identity system is a genuinely harder problem, and it's worth explaining honestly rather than letting "we support 2FA" stand in as if it were uniformly true everywhere.
The current state, specifically: TOTP-based two-factor authentication exists today in exactly 2 of Piskes's 17 apps — chat and knowledge — implemented through Better Auth's two-factor plugin, which those two apps use as their identity system. The other 15 apps run on a separate identity path, a Go-backend JWT cookie flow, which has no MFA support and no organization-wide enforcement policy today. If your team's security requirements depend on 2FA being available and enforceable everywhere someone can sign in, that requirement isn't met yet outside chat and knowledge specifically.
This is a real gap, not a rounding error, and it exists for a structural reason worth naming: the two apps with 2FA today are the two running on a different, newer identity system than the other fifteen. Adding 2FA uniformly means either bringing all 17 apps onto one identity system first, or building equivalent MFA support into the older Go-JWT path independently — neither of which is a small, incidental addition on top of an app that already works. That's the actual reason suite-wide MFA lags behind single-app MFA, and it's a more honest explanation than either silence or a vague "coming soon."
The direction is toward consistency, not away from it — but the accurate way to describe today's state is current coverage, not a completed rollout: two apps have real TOTP two-factor today; the other fifteen don't yet, and there's no platform-wide enforcement policy across all of them. A security reviewer checking this claim against the actual apps deserves that precision rather than a suite-wide claim that only holds for a fraction of the suite.