Problem setting up 2FA on beehaw.org (beehaw.org)

submitted 1 year ago by chahk@beehaw.org to c/support@beehaw.org

13 comments fedilink hide all child comments

I go to Settings, check the "Set up 2-factor authentication" box, click Save, reload the page, but clicking on "2FA installation link" does nothing. I tried copying the "secret" value from the link and using it to manually add an account in my 2FA app (Authy) but that doesn't seem to work. The account gets added, but the codes it generates don't seem to work for logging in (using a different browser).

I really don't want to lock myself out. Am I doing something wrong, or is this a known issue?

top 11 comments

sorted by: hot top controversial new old

[-] ericjmorey@beehaw.org 8 points 1 year ago

2FA is effectively a failed implementation in Lemmy

[-] Penguincoder@beehaw.org 2 points 1 year ago

Hey there, we don't want you to lock yourself out either. Unfortunately 2FA for lemmy is not up to par. I'd suggest staying away from it for the time being.

Before you do happen to lock yourself out, please make sure your account has an email address associated; then you can reach out to us on Discord or Matrix, we can reset it for you.

[-] chahk@beehaw.org 1 points 1 year ago

Appreciate it. Added email to my account just in case, but I'm going to leave 2FA alone for now.

[-] I_Am_Jacks_____@beehaw.org 1 points 1 year ago

My experience: Beehaw/Lemmy is using a SHA256 hash for the secret key. A lot of 2FA apps only support SHA1. So you'll need to find one that supports SHA256. I used Google Authenticator. I thought I also saw that Microsoft Authenticator works too. Storing in Bitwarden doesn't work.

Good luck.

I would definitely do all my testing in private browsing or another browser while leaving a browser window logged in to disable 2FA should you need to.

[-] kkaosninja@beehaw.org 2 points 1 year ago

I have Bitwarden. Don't have an issue. What issue did you run into?

[-] I_Am_Jacks_____@beehaw.org 2 points 1 year ago

Storing the secret key inside bitwarden produced incorrect codes. Due to Bitwarden only supporting SHA1 while Lemmy/Beehaw using SHA256.

[-] kkaosninja@beehaw.org 3 points 1 year ago* (last edited 1 year ago)

I just checked the 2FA codes stored in my Bitwarden. Ends with algorithm=SHA256&issuer=Beehaw. Also logged out and logged in again before posting this comment.

Don't think SHA-256 is the issue.

One usual cause of incorrect 2FA codes is incorrect system time. You can use https://time.is/ to see if that's the case.

[-] I_Am_Jacks_____@beehaw.org 1 points 1 year ago

Maybe it's a Vaultwarden self-hosting issue (vs. using bitwarden.com). Or maybe it's that you're using the Bitwarden TOTP app whereas I'm referring to the Bitwarden password manager.

All of the other codes inside my Vaultwarden password manager are working except this one. I added "&algorithm=SHA256&issuer=Beehaw" and that did not help.

[-] ryonia@beehaw.org 4 points 1 year ago* (last edited 1 year ago)

Not sure what the Bitwarden TOTP app is, totp is build into the default clients.

I'll also confirm that 2fa with beehaw at least is working for me. Vaultwarden shouldn't make a difference, it's just the data host, your client is the one decoding and then generating the otp.

My advice, you shouldn't have to add anything. Copy the totp link from your lemmy instance and paste the entire link into the Authenticator Key field in the bitwarden entry. The link should start with otpauth://totp/. Don't remove anything from the link, it'll work as is.

If you're finding it's still not giving you the correct code, the only other thing that comes to mind is to make sure your device's time is synced and accurate. TOTP codes are time sensitive, and if the device's time is desynced, you will get incorrect codes generated.

Good luck.

[-] I_Am_Jacks_____@beehaw.org 3 points 1 year ago

You are, as you already know, absolutely right. I even found documention on the web supporting my findings so I didn't look further. But pasting the WHOLE URL allowed me to add it to Bitwarden.

Thank you!