-
Notifications
You must be signed in to change notification settings - Fork 150
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Backup codes are saved before user intends #507
Comments
Alternatively, I might suggest we change the button to |
That (or some text near the button) could be a good alternative 👍🏻 The most important thing is that the user is informed about what will happen.
I was thinking of situations where the user accidentally clicks the button, or when they click it and then want to "undo" that by leaving the page without saving. That could be the case if someone is running low on codes and decides to regenerate, but then discovers their printer isn't working or something, so they want to come back and do it later. Those are admittedly edge cases, though.
That's a fair point, especially since the current precedent is that you don't need to. Not having to click This isn't something I feel strongly about, though, it's an edge case and I can see your point of view 👍🏻 |
Perhaps some kind of confirmation dialogue would help with the accidental (or intentional) click, and draw their attention to the fact that codes will be updated? |
This could be dealt with the same as the TOTP setup process. Rather than generating and saving them server-side before showing the UI, they could be generated, provided to the client, and only hashed/saved server-side upon a second API request after user action. If we need to validate that the server generated the codes (to prevent someone sending bad-random codes?) a signature could be included if required.. That wouldn't prevent the UI being changed to "Generate and save" though. |
A better procedure is needed indeed. Locked my .org account yesterday, as I didn't expect visiting the backup codes page also to trigger those to be activated. Especially since I didn't manage to set up any TOTP a few moments earlier (because of now fixed bug). Is there a reason why backup codes should even be generated if 2FA is not activated? |
Currently, clicking the
Generate verification codes
button will generate codes and save them to usermeta. I think most users will only expect the codes to be saved if they click theUpdate Profile
button.If they navigate away from the page without clicking that, they'll assume nothing has changed, but in reality it has. This can be a problem if they already had existing codes, and accidentally clicked the button, or clicked it intentionally but then decided they didn't want new codes. Their old codes are now invalid, but they don't know that and won't save the new ones. They could be locked out in the future because their saved codes no longer work.
The text was updated successfully, but these errors were encountered: