[DigitalPoint] Security & Passkeys 1.1.8

[TPerry]

Having issues with the Authy App where when trying to verifiy adding the 2FA with the generated code I get the message:-

The two-step verification value could not be confirmed. Please try again.

Authy app (iPhone) had issues with the QR code for my site... and I went around and around with them and they eventually said that they fixed it.

XF 2.2 - Authy & 2FA "Token format invalid"

When trying to use Authy with the Google open source generated QR code, I'm getting this. Google Authenticator and 2FA Authenticator (on my iPhone and my iPad) work fine. The QR code here works fine with Authy also. I do have several of Xon's add-ons installed, but I disabled them and the...

xenforo.com

I kicked Authy to the curb and now use the YubiKey app and 1FAS Auth (which backs up to iCloud).

 

[GameNet]

Hi @digitalpoint

I am receiving errors when I trying to verify my passkey but it’s showing this error

The two-step verification value could not be confirmed. Please try again.




also I am not receiving any errors in adminCP and I am using iOS Safari and iPadOS Safari

also sometimes this happens on edge!

 

[TPerry]

Have you tried dropping down to a more reasonable level of trusting the device.. you know, a more standard 30-90 day period?

 

[digitalpoint]

Are you getting any server side errors in your error log?

 

[GameNet]

Are you getting any server side errors in your error log?

As I said no I am not

 

[digitalpoint]

As I said no I am not

Is it specific to a single account (do you have a test account you could test it on)? Is the time on your server correct?

 

[GameNet]

Is it specific to a single account (do you have a test account you could test it on)?

I don’t known

Is the time on your server correct?

I am not sure what do you mean the server is shared hosting

 

[digitalpoint]

I don’t known

I am not sure what do you mean the server is shared hosting

I just mean in the XenForo error log in the admin area.

 

[GameNet]

st mean in the XenForo error log in the admin area.

There is no error relate to your add-on

 

[digitalpoint]

Well, I’d say the best thing to do would be to test a passkey from a test account. Then you can at least see if it’s specific to the server or the user.

 

[GameNet]

Well, I’d say the best thing to do would be to test a passkey from a test account. Then you can at least see if it’s specific to the server or the user.

I will do that tomorrow once I have more time

 

[digitalpoint]

Another thing you may want to test if you can is to add a second passkey to the same account and see if that one works (maybe it’s something about that individual passkey somehow).

 

[GameNet]

Another thing you may want to test if you can is to add a second passkey to the same account and see if that one works (maybe it’s something about that individual passkey somehow).

I will check this one later once I have more time

 

[digitalpoint]

Just thought of something else you could check... if you have something that could be altering the network request before it hits your server, that could be an issue too. Some suspects:

• browser extensions/ad blocker
• something like Cloudflare and you have it's "security level" cranked up
• mod_security (or something similar) installed with your server

Long story short is there is a JSON payload that needs to make it to your server, so if you have something that is looking for anything that might look "suspect" and blocking/altering it, it's going to break the underlying function.

 

[GameNet]

Is it specific to a single account (do you have a test account you could test it on)?

It’s looks like it’s all the account if you enabled security passkey when using apple passkey! I have test it on GameNet account and administrator account still showing the same error!

browser extensions/ad blocker

I do use ad-blocker as I am not a big fan of scams and misleading ad but its still showing me the error!

something like Cloudflare

I don’t use Cloudflare at the moment and but I do have plans to enable in the future!

mod_security (or something similar) installed with your server

I have already turned off Mod Security but its still showing the same error!

something similar) installed with your server

I have just already tried to disable all add-on except your security add-on and its still showing the same error!


I am not sure what’s going on!

 

[digitalpoint]

Maybe try deleting the passkey and readding after you disabled things like mod_security. I suppose it’s possible the passkey info was kicked by something during the process that saves it when you set it up.

FWIW, I just went through the process with an iPhone Passkey (saved to iCloud), and creation worked as expected and I was able to log out and back in (and authenticate with it) without any issues. Tried it just now…

 

[GameNet]

I am trying to click the button not clickin or tabbing

here a video
View attachment RPReplay_Final1693948554.mp4

 

[GameNet]

FWIW, I just went through the process with an iPhone Passkey (saved to iCloud), and creation worked as expected and I was able to log out and back in (and authenticate with it) without any issues. Tried it just now…

Have you test this on XenShop

 

[digitalpoint]

Have you test this on XenShop

No idea what that is, so no. I’ve tested it with XenForo.

 

[GameNet]

its not working on my side

here a video what’s I meant

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies