19
Do we have 2FA on lemmy ?
(lemmy.dbzer0.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 03 Jul 2023
19 points (95.2% liked)
Asklemmy
43783 readers
848 users here now
A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
In the web interface there is a setting for 2FA but I couldn't get it to work. For some reason there is no QR code to scan but a link of some kind that does nothing.
Thanks, I will take a look.
It's a
otpauth://protocol handler link, which should load fine on mobile if you have an app that supports it.I do agree that displaying a QR code while on desktop would be more practical. As a workaround, you could use this addon on Firefox to display the
otpauth://link in a QR code format and scan that.I got it to work with 1Password, but it seems unfinished and very risky.
To get it to work, I copied the link that the "2FA installation link" button points at, and pasted that into a new 2-factor field in 1password. It presumably was able to extract the secret and start generating the codes. I've tested it and it works.
However, it's risky because Lemmy doesn't verify you have the correct codes before enabling 2FA. It just assumes you'll be able to use the cryptic link for something. So if you log out before you've set it up, and you mess up the set up, you might not be able to get back in. There are no backup codes as far as I can tell.
So if you do attempt it, I would recommend keeping a device logged in so you can disable it if it goes wrong.
For me on iOS it asked me to associate with my iPhone keychain or 1Password. Works great. Dunno what that does elsewhere.