Twofactor by Reflar

Kyrne

XxPoNaGeXx Hmm, I wasn't able to reproduce on your website. It scanned the bar code just fine, and I successfully enabled twofactor. Could you send me a screenshot of your twofactor barcode? (please regenerate your code after you send it to me for security reasons)

XxPoNaGeXx

Kyrne code removed

Kyrne

XxPoNaGeXx Hmm, even that one scanned fine into my phone. I don't think it is the extension's problem. Could be related to the app. (I'm using the official google authenticator app). Are you using iOS or Android?

XxPoNaGeXx

Kyrne I am using that app also ? on IOS

Kyrne

XxPoNaGeXx

0.1.0-beta.3

Fix iOS incompatibility

It is now very important you use https in tandem with this extension.

(Which you should be doing anyway because you are handling people's data)

XxPoNaGeXx

Kyrne how do I update?

Kyrne

XxPoNaGeXx run composer update reflar/twofactor in your Flarum root dir. If you have Bazaar give it 60 minutes to pull the update, then it should prompt you.

Kryonoglou

Can you make extension for phone verification on the register form?
I think this is very good idea.
Think about it. ?

tankerkiller125

Any option for U2F using the WebAuthn API in the future for those of us with U2F keys?

Kyrne

0.1.0-beta.4

Beta 8 Compatibility
Added UserEnabledTwoFactor event

Updating ⬆️

Make sure you are running Flarum beta 8, this update will not work on any other version
Run the follow commands (in this order) in your Flarum root directory:
- composer update reflar/twofactor
- php flarum migrate
- php flarum cache:clear

peopleinside

@Kyrne I made a question in another topic but you can reply here.

Will be nice be able to choose to receive two factor code by email without need an app and also maybe add as alternative method email in case the code in the app was loosed like when Google Authenticator are inaccessible or uninstalled without before remove the 2 factor.

Thanks for this extension.

Kyrne

peopleinside I am personally against email codes as they go to the same place as your password reset emails, which defeats the purpose of twofactor.

Funny you should bring this up now because I'm working on authy one touch would should hopefully help with the problem of losing access to Google authenticator.

In terms of getting back into admin, disable the extension from the settings table in mysql, and make sure to unblock the route in nginx.

Ninja edit: you should only disable it if you, or someone you can 100% verify it is themselves, a hacker may try to get you to disable it so they can get into an account.

peopleinside

Kyrne So if an user are unable to login because loose two factor code, admin seems unable to help.
Oh found need set the relative row in the user database profile from 2 to 0.

Seems at the moment when you activate two factor a red message say ops, error but refreshing the page two factor are activated 🙂

Kyrne

peopleinside that's the point, if you lose twofactor you can't login. Countless websites (Google, PayPal, teitrer, Facebook, GitHub) all say that if you lose access to twofactor you can't get into your account.

There are recovery coes however (but they look like they aren't generating for you) just in case you lose it.

Ralkage

Kyrne Let's not forget GitLab and how I got locked out of my original account 🤣 2FA is on Apple products as well.

peopleinside

Ralkage I love use two factor auth and usually i never get out unable to login.
I use two step all where i can do... my question was only for be sure to not loose forum access and as admin can manage all situation.

Maybe i found all replies and now i had activated it. Thanks

Kyrne

peopleinside

0.1.0-beta.4.1

Fix for recovery codes not showing

Updating ⬆️

Run composer update reflar/twofactor
Clear your cache

peopleinside

The extension seems doesn't work with Beta 8.1 released today. Extension is active and updated but no two factor are asked and no two factor option are showed on user profile. @Kyrne

Also i tested if i add the htaccess code you mentioned i am unable to login actually on the account where the two factor are active but not work in Beta 8.1 , i tested also i am unable to login also from a user account that has not two factor active. If i remove the htaccess lines all work fine... so? Seems i cannot keep this line in htaccess.

Kyrne

peopleinside did it work for you on beta 8? 8.1 didn't introduce any breaking changes so that's peculiar.

peopleinside

Kyrne yes was working. After update to Beta 8.1 is not working. Is active but nothing... i can login without two factor also if i deactivate it and reactivate there is no two factor button on the profile.

I removed the extension for try to reinstall but gives errors:

[...]$ composer remove reflar/twofactor
Dependency "flarum/core" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 0 installs, 0 updates, 6 removals
  - Removing twilio/sdk (5.26.0)
  - Removing symfony/polyfill-util (v1.10.0)
  - Removing symfony/polyfill-php56 (v1.10.0)
  - Removing reflar/twofactor (0.1.0-beta.3)
  - Removing pragmarx/google2fa (v3.0.3)
  - Removing paragonie/constant_time_encoding (v2.2.2)
Writing lock file
Generating autoload files
[...]$ composer require reflar/twofactor
Using version 0.1.0-beta.4.1 for reflar/twofactor
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Can only install one of: flarum/core[v0.1.0-beta.8.1, v0.1.0-beta.8].
    - Can only install one of: flarum/core[v0.1.0-beta.8, v0.1.0-beta.8.1].
    - Can only install one of: flarum/core[v0.1.0-beta.8, v0.1.0-beta.8.1].
    - reflar/twofactor 0.1.0-beta.4.1 requires flarum/core 0.1.0-beta.8 -> satisfiable by flarum/core[v0.1.0-beta.8].
    - Installation request for reflar/twofactor 0.1.0-beta.4.1 -> satisfiable by reflar/twofactor[0.1.0-beta.4.1].
    - Installation request for flarum/core (locked at v0.1.0-beta.8.1, required as ^0.1.0) -> satisfiable by flarum/core[v0.1.0-beta.8.1].
    - Installation failed, reverting ./composer.json to its original content.

Kyrne

peopleinside I'm guessing it's a cache issue, the .htaccess rules will not break login if two factor is running. I pushed a new update to allow beta 8.1 to work.

« Previous Page Next Page »