Inactive 2FA Report - Incorrectly reporting "GOOD NEWS No websites were found in your vault with a missing two-factor authentication configuration."

[sambartle]

Describe the Bug

When logging into the Web Vault and running the "Inactive 2FA Report" from the UI, the report always returns "GOOD NEWS
No websites were found in your vault with a missing two-factor authentication configuration."

Steps To Reproduce

1. Login to Web Vault
2. Navigate to Tools Tab
3. Click Inactive 2FA Report

Expected Result

The report should identify any sites with 2FA which do not have Tokens setup in Bitwarden.

In my personal case I have a significant number including at least the following which are configured in my Google Authenticator application on my phone: (7 different google or gsuite logins, amazon, 2AWS, 5 microsoft logins, paypal, 3 OVH logins, cloudflare, epic games, evernote, facebook, humble bundle, IFTTT, Instagram, Oculus, Ubisoft, Knowbe4, ultimaker.)

Actual Result

Report always returns:
GOOD NEWS
No websites were found in your vault with a missing two-factor authentication configuration.

Screenshots or Videos

Report Results

Example of Unconfigured TOTP for a common site with 2FA the report should be listing

Environment

• Operating system: Windows 10 Pro Build 20H2
• Browser: Chrome 88.0.4324.182 (x64)
• Build Version (Bottom of the page): 2.18.1

Additional Context

Raised from https://community.bitwarden.com/t/inactive-2fa-report-no-websites-were-found/18088/3

[bastervrugt]

Same here.

The api request fails:
Access to fetch at 'https://twofactorauth.org/api/v1/data.json' from origin 'https://vault.bitwarden.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[sambartle]

Same here.

The api request fails:
Access to fetch at 'https://twofactorauth.org/api/v1/data.json' from origin 'https://vault.bitwarden.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Interesting..
It would seem that the domain this is pointing too (which was linked to a GitHub project (https://github.com/2factorauth/twofactorauth) to create a list of 2FA sites).. has actually been bought by someone else as it expired..

Bitwarden could locally replicate the list (since its on Github here https://github.com/2factorauth/twofactorauth/tree/master/_data and available for use)

[cscharf]

@sambartle , thanks for the report, all fixed (live), thanks to @phallobst for the contributed fix (beat us to the punch).