SOLVED: After getting spooked turned on 2FA for lemmy.world account, but the code to scan for my Auth app never appeared, the screen refreshed, logged me out, and I can't get back into my account now
Is there anything I can do, or is that account lost forever now? Resetting the password doesn't work (natch). Not a huge deal, but it's upsetting because I was modding a community from that account. Any tips/contacts would be appreciated. Cheers.
*** update: as per commenters suggesting, tried resetting password for that account once again, and I was successfully able to log in, go to my settings, then remove 2FA, and all seems good now
I did the same thing on a different Lemmy instance, probably for the same reason. I just created a pull request to fix the broken instructions - pull 88.
Nothing is lost, but I'm quite sure that the instance admin will need to disable 2FA in your account for you to regain access, however I suspect that the lemmy.world admin is going to be busy for a while due to the recent exploit.
FWIW I found the string for 2FA if you right click open link in New window. Then you can read the string to import into an authenticator app from there. Had it generating codes but the codes wouldn't let me login on my app so I disabled for now. Hope they can fix this in the future.
for some reason, which has to be fixed soon because it’s a huge security risk, you can log back into your account without 2fa after resetting your password via email
Always worth - whenever you change authentication settings - opening a new incognito tab and try signing in.
If it fails, hopefully your actual tab is still authenticated so you can disable/edit
This happened to me on my beehaw account when they first announced 2FA. The accounts are now gone for us. Just saw the edit... going to see if that works for me. I might be hosed though because I'm not sure I entered an email.
Can you elaborate? I've got it enabled and working on my personal instance running 0.18.1. Is there an authentication check that isn't actually happening in the login flow or something?
FYI if this is because of the cross-site attack on Lemmy.world you should know 2FA will NOT help as the attacker accesses the JWT key directly which has already been signed in w/2FA. The only way to mitigate it is to use a native app and not the web or PWA version.