this post was submitted on 17 Jul 2023
134 points (100.0% liked)

Blahaj Lemmy Meta

2445 readers
30 users here now

Blåhaj Lemmy is a Lemmy instance attached to blahaj.zone. This is a group for questions or discussions relevant to either instance.

founded 2 years ago
MODERATORS
blahaj@lemmy.blahaj.zone
supakaity@lemmy.blahaj.zone
ada@lemmy.blahaj.zone
134
Make sure you are logged in to multiple browsers before enabling 2 factor (lemmy.blahaj.zone)
submitted 2 years ago by ada@lemmy.blahaj.zone to c/main@lemmy.blahaj.zone
20 comments fedilink hide all child comments
 

We've had several people reach out to us who have accidentally locked themselves out of their account whilst trying to setup 2 factor authentication.

Whilst it is possible for us to disable 2fa for an account directly from the database, for privacy and security reasons, we won't do this at the request of an external/second account.

However, all is not lost! Enabling 2fa will not log you out of existing sessions, so if you make sure you are logged in to a second browser before enabling 2fa, you will be able to disable it again if you run in to any issues.

top 19 comments
sorted by: hot top controversial new old
[–] cupcakezealot@lemmy.blahaj.zone 29 points 2 years ago

I was surprised they didn't have backup codes or anything when I set it up so I got nervous hopefully they'll get added soon too.

[–] Sagethefolxhero@lemmy.blahaj.zone 20 points 2 years ago (1 children)

This was me 😑

[–] ada@lemmy.blahaj.zone 13 points 2 years ago (1 children)

At least you had access to an app and could message us from your account.

[–] Sagethefolxhero@lemmy.blahaj.zone 9 points 2 years ago

Very true and also thank you!

[–] princessnorah@lemmy.blahaj.zone 17 points 2 years ago

Hopefully they add recovery keys to the 2FA setup sometime soon.

[–] punkskunk@sh.itjust.works 12 points 2 years ago (1 children)

If you have an email address associated with your account you can follow the “forgot my password” account recovery process. This will log you in without prompting for your 2fa.

I’m not sure it’s great security, but it is a self-service recovery option if 2fa has locked you out.

[–] load_nikon@lemmy.world 1 points 2 years ago (2 children)

I have completed that process and upon login I am still being prompted for 2fa that I did not set up.

[–] punkskunk@sh.itjust.works 4 points 2 years ago (1 children)

Here’s the process I used a few weeks ago. I’m going from memory and things may have changed since then, this may no longer work.

  1. Click “forgot password” on the login page of your instance.
  2. Enter your email address
  3. Click the link you receive in your email
  4. Enter your current password in both fields and click Save
  5. You will be logged in. Go to your settings and disable 2fa.
[–] ada@lemmy.blahaj.zone 5 points 2 years ago (1 children)

Thanks for this. I'll keep it in the toolbox of things I get people to try

[–] load_nikon@lemmy.world 1 points 2 years ago

Did this, see above. Did not work.

[–] averyfalken@lemmy.blahaj.zone 1 points 2 years ago

That's an interesting way to handle the issue

[–] Still@programming.dev 8 points 2 years ago (1 children)

oh yeah there's no confirmation for setting up 2fa right now, so make sure you got codes going before logging out

[–] load_nikon@lemmy.world 2 points 2 years ago

That is bonkers!

[–] ltouroumov@lemmy.blahaj.zone 5 points 2 years ago* (last edited 2 years ago)

The 2FA is so secure even the user can't access their account. 😛

[–] nobleart9932@lemmy.blahaj.zone 3 points 2 years ago

I feel bad for you on this one, clearly some 2FA is better than no 2FA, but the implementation of this from the Lemmy devs leaves a lot to be desired. Ah well, they are clearly trying, and I am sure it will get better

[–] load_nikon@lemmy.world 3 points 2 years ago (1 children)

I'm getting prompted for 2fa and I never set it up! The 2fa apps I use would have this site added to their list if I had. @Ada, any suggestions?

[–] ada@lemmy.blahaj.zone 3 points 2 years ago (1 children)

Someone else said that you can do a password reset to login without 2fa. I haven't tested it, but it's worth trying

[–] load_nikon@lemmy.world 1 points 2 years ago (1 children)

Yeah, that didn't work for me. Do you have any recommendations, as the administrator of this instance, on how a user can remediate a 2fa implementation that is failing so wildly that it requires this thread to exist? Do you have a "whoops, do over" button?

[–] ada@lemmy.blahaj.zone 4 points 2 years ago

The brutal truth is that Lemmy as a platform isn't mature and probably wasn't ready for the scale of growth.

I'm trying to put out fires for an app I didn't develop and have no input in to. I wish there was an oops button!

What I'll get you to do is DM me the email address of the account that's locked. I'll confirm the email address and then send you an email at that address

load more comments