Is 2FA for the forum broken?

Forum Feedback
1

I was told that the code is invalid and can be used only once. Had to login using a backup code.

2

Oh, I didn’t know there is 2FA! :smile: @_MP

2 Likes
3

I experienced this, too, using Google’s Authenticator app.

Switched to Microsoft’s Authenticator and things work smoothly now.

4

Is the 2FA required on every log-in, or is it once you’ve authenticated a computer, it doesn’t ask again? I wouldn’t mind registering once per computer, but wouldn’t want to do it each time I use the website.

5

It’s using TOTP, the app generating the code shouldn’t matter.

2 Likes
6

Weird… Nothing changed on the forum (I mean, I make sure we’re always updated to its latest version). Please let me know via DM if you encounter the issue another time.

1 Like
7

For TOTP (this is what Google Authentificator uses) it is important that the time and date are correct.

8

Thanks for your advice.

Despite having worked for Google I didn’t want to insist on the Google Authenticator working for this* but was happy that the Microsoft Authenticator just worked when I first tried.

I attribute this non-discriminating attitude to getting older – I won’t insist on being right as long as it works. Both authenticators probably offer about the same level of security, even if I have only had exposure to an inside view at one of them. :wink:

* Admittedly I disabled 2FA, de-registered and tried to re-register with the Google Authenticator app, but no luck.
I’ll say it felt a little odd since the Google Authenticator app had worked for years until it didn’t.

1 Like
9

TOTP should use the same algorithm, so I guess it is just a time issue. Can you verify that each app produces the same code? Maybe you can see if one generates with a delay.

10

Pay me for debugging this as you suggest and I’ll do it.

If not, I’ll waste my time instead on posting comments like this one on this forum.

:wink:

1 Like
11

Well, if you photograph the QR code on both apps, you should see the code on both.

12

I deactivated 2FA and tried to reactivate it. It doesn’t accept the TOTP.

Tagging @_MP .

13

Have you checked your local time and timezone?