[nodebb-plugin-2factor] Two-Factor Authentication
-
In addition to regular authentication via username/password or SSO, a second layer of security can be configured, permitting access only if a time-based one-time password is supplied, typically generated/stored on a mobile device.
The Two-Factor Authentication plugin will expose this feature to end-users, allowing them to configure their
devices and enabling this enhanced security on their account.Requirements
- Requires NodeBB v0.7.2 or newer.
Installation
Install the plugin via the ACP/Plugins page.
Screenshots
Token Generation Step
Challenge Step
Changelog
v1.0.2
- Added the ability to disassociate user tokens via the ACP page (in case users get locked out)
v1.0.3
- Bug: Fixed the browser title on the TFA settings page
- Bug: Fixed issue where hitting enter while keying in the validation code would abort the process
2-factor is: 7.4.0
Board is: v3.5.1. -
In addition to regular authentication via username/password or SSO, a second layer of security can be configured, permitting access only if a time-based one-time password is supplied, typically generated/stored on a mobile device.
The Two-Factor Authentication plugin will expose this feature to end-users, allowing them to configure their
devices and enabling this enhanced security on their account.Requirements
- Requires NodeBB v0.7.2 or newer.
Installation
Install the plugin via the ACP/Plugins page.
Screenshots
Token Generation Step
Challenge Step
Changelog
v1.0.2
- Added the ability to disassociate user tokens via the ACP page (in case users get locked out)
v1.0.3
- Bug: Fixed the browser title on the TFA settings page
- Bug: Fixed issue where hitting enter while keying in the validation code would abort the process
I also noticed that the 2fa isn't working for me too.
I generate the first code to test the application, that works, but when i want to log in later, it doesn't recognize the code, and i have to use a backup code -
In addition to regular authentication via username/password or SSO, a second layer of security can be configured, permitting access only if a time-based one-time password is supplied, typically generated/stored on a mobile device.
The Two-Factor Authentication plugin will expose this feature to end-users, allowing them to configure their
devices and enabling this enhanced security on their account.Requirements
- Requires NodeBB v0.7.2 or newer.
Installation
Install the plugin via the ACP/Plugins page.
Screenshots
Token Generation Step
Challenge Step
Changelog
v1.0.2
- Added the ability to disassociate user tokens via the ACP page (in case users get locked out)
v1.0.3
- Bug: Fixed the browser title on the TFA settings page
- Bug: Fixed issue where hitting enter while keying in the validation code would abort the process
@RazielKanos I just tested v7.4.0 against latest
developand there are no issues with registering 2FA.Just to be sure I also waited until the code rolled over to a new set and that also worked. Any errors on the backend?
Could it be your server clock is out of sync? If it is too far out, then the code it is expecting will not match your code.
-
In addition to regular authentication via username/password or SSO, a second layer of security can be configured, permitting access only if a time-based one-time password is supplied, typically generated/stored on a mobile device.
The Two-Factor Authentication plugin will expose this feature to end-users, allowing them to configure their
devices and enabling this enhanced security on their account.Requirements
- Requires NodeBB v0.7.2 or newer.
Installation
Install the plugin via the ACP/Plugins page.
Screenshots
Token Generation Step
Challenge Step
Changelog
v1.0.2
- Added the ability to disassociate user tokens via the ACP page (in case users get locked out)
v1.0.3
- Bug: Fixed the browser title on the TFA settings page
- Bug: Fixed issue where hitting enter while keying in the validation code would abort the process
Is it possible to have 2fa by email?
-
Is it possible to have 2fa by email?
@darkpollo that I my view defeats in entire purpose of 2fa. If your email was hacked, they'd also have the two factor which is what your are looking to secure in the first place.
-
@darkpollo that I my view defeats in entire purpose of 2fa. If your email was hacked, they'd also have the two factor which is what your are looking to secure in the first place.
@phenomlab @darkpollo agreed. If there's a need for it it'd be a good separate plugin, same for a "magic link" style login plugin.
