Two Factor Auth 1.1.1

[Liam W]

Liam W updated Two Factor Auth with a new update entry:

New Features

This update introduces full support for admin login.

The front-end login has also been changed, with a phrase now directing people to the contact form link if they have lost access.

Please be aware that the permission ID has been changed, so permissions will need to be reset!

Read the rest of this update entry...

 

[rugk]

The front-end login has also been changed, with a phrase now directing people to the contact form link if they have lost access.

Can you turn this off in the settings?
Because usually no admin can (or should) restore access for a user who claims that he lost access to his OTP app/device - anybody can claim this.
If an admin would do this the whole 2FA is useless.

 

[Liam W]

Can you turn this off in the settings?
Because usually no admin can (or should) restore access for a user who claims that he lost access to his OTP app/device - anybody can claim this.
If an admin would do this the whole 2FA is useless.

Remove the phrase content or edit the template.

 

[Robru]

The front-end login has also been changed, with a phrase now directing people to the contact form link if they have lost access.

Hello Liam,
What can you do as an admin if an user have lost access. What do you need to disable a user in the database so that they can log in again?

 

[Liam W]

Hello Liam,
What can you do as an admin if an user have lost access. What do you need to disable a user in the database so that they can log in again?

On the edit user admin page, there is a remove two factor auth option in the drop down in the right hand corner.

Liam

 

[Robru]

Thank you very much

 

[rugk]

However as said if you do so this effectively disables 2FA. Because if you grant him access you would have to verify that he is really the original user and/or is the owner of the device which he uses (or has used) for 2FA. And of course he would still have to have access to this device - a lost device could also be misused by anyone.

 

[rugk]

BTW is there an option/permission to separately allow/disallow E-Mail and Google Authenticator OTP (in fact the correct name for Google Authenticator would be TOTP)?

 

[m1ne]

Liam, I'm getting an invalid code every time when trying Google Auth.
Email OTP doesn't work either. I select it, save, and it's reset back to Disabled. Any idea?

 

[m1ne]

@Liam W I get that error with the other 2fa addon as well, so it must not be your addon. Still, any idea how to fix that?

 

[Wesker]

Good mod. Would be willing to pay with for this if it was maintained.

 

[Chris D]

It's not required. It's built into XenForo 1.5.

You can test it out here: https://xenforo.com/community/account/two-step

 

[Liam W]

Good mod. Would be willing to pay with for this if it was maintained.

The functionality from this add-on is now in XenForo 1.5 core.

 

[rugk]

Welll you don't have to. In Version 1.5 of XenForo, which is currently in Beta, it is included:

XF 1.5 - Two-Step Verification and Security Improvements

 

[rugk]

Oh 3 posts and the same idea.