Web analytics: Umami is introducing two-factor login

Webanalyse software Umami has introduced two-factor authentication (2FA) with its latest version, 3.3.0, enhancing security measures for users who self-host the platform. The update allows identified users to link their sessions across multiple visits and devices, offering more comprehensive tracking capabilities. Additional features include session and event property filters, copyable dashboards, mini-charts within tables, and an improved bounce rate detection system tailored for single-page applications. Umami is an open-source, privacy-focused alternative to Google Analytics, designed to run on private infrastructure. It collects data such as page views, events, referrers, and session information. Since version 3.0, the project has exclusively used PostgreSQL as its database backend. Previous updates, including version 3.2, added heatmaps and enhanced analytics capabilities. The core addition in Umami 3.3.0 is support for Time-based One-Time Password (TOTP)-based 2FA. Users can set up the second factor via a QR code or manually entered key using an authenticator app. If the second factor is lost, Umami generates ten one-time-use backup codes. Administrators have the option to enforce 2FA globally or for specific users or teams. They can reset the second factor if needed. To prevent brute-force attacks, the application limits login attempts through rate limiting, after five failed entries, further attempts are blocked for 15 minutes. Detailed documentation provides additional guidance on these features. For self-hosted installations, configuration adjustments are necessary before enabling 2FA. Operators must set a secret configuration value called TWO_FACTOR_ENCRYPTION_KEY. Umami encrypts stored 2FA secrets using AES-256-GCM with this key. If the key is lost or replaced, existing 2FA registrations become unreadable, requiring affected users to reconfigure their second factor. Umami now merges sessions retroactively when an application identifies a visitor. This applies to web applications that pass an internal user ID to the tracker after logging in. If a user later accesses the application on a different device, Umami can display activities from both sessions under a shared profile. While the underlying sessions remain separate, they are linked through a unique identifier known as the Distinct ID. Profiles show the number of linked IDs, providing operators with a complete view across multiple devices and visits. However, it is recommended to continue using internal or hashed identifiers instead of email addresses to avoid unnecessary personal data in analytics. New filters allow users to evaluate sessions and events based on specific properties. For example, users can filter sessions by customer subscription tier or analyze events with particular feature flag configurations. Umami enforces unique entries for session data at the database level and optimizes queries related to session activity. Customizable dashboards, referred to as “Boards” within the project, can now be cloned. Teams can duplicate existing conversion dashboards and adapt them for new campaigns or products without rebuilding each widget individually. Sparklines appear in tables for websites, links, and tracking pixels, showing recent trends directly within the table. These small line charts help identify notable projects quickly but do not replace detailed time-series analysis. Introduced in version 3.1, Boards provide flexible views combining charts, tables, and metrics. When setting up a new website, Umami now guides users through integrating the tracking code, aiming to reduce configuration errors during initial setup. The updated bounce rate detection system improves accuracy in identifying user interactions on single-page applications.