"Invalid username or password (401)" with 2FA enabled

[tuxmaster5000]

I only get the error:
(17:18:12) connection: Connection error on 0x5562b073dc10 (reason: 2 description: Invalid username or password (401))
When I use my facebook password, then I get an new pin via SMS, but after enter the pin, the error will shown again.

[stumyp]

Same here, not sure why. Probably Facebook changed something?

[ViperGeek]

+1

[hollystandring]

Yeah I'm getting this too

[zyphlar]

I've been getting "invalid username or password (401)" for weeks now, however in order to test I tried re-entering my password (I have 2FA enabled) and after I disabled 2FA it worked just fine. Maybe something changed in FB's 2FA process.

Reproduction steps (with 2FA enabled on FB account:)

• Enter username and password
• FB responds with a message saying to expect an SMS login code
• In my case, no code was received.
• If you do receive a code, enter it into the password field and reconnect.
• Note the error message "invalid username or password (401)"

Fix steps (when 2FA is enabled):

• Disable 2FA in Facebook
• Enter real password into Pidgin's FB password prompt
• Note you are now logged in

[languitar]

Same issue here with 2FA enabled

[isakrubin]

Same issue with 2FA enabled

[dequis]

I'm willing to bet this is related to the newer 2fa auth flow found at #445, which I couldn't implement at the time as it wasn't deployed. That issue "fixed itself" with a server-side fix of app password support.

So pretty sure the flow of entering SMS code as the password is dead, but have y'all tried app passwords? https://www.facebook.com/settings?tab=security&section=per_app_passwords&view

[marcelvb]

I have the same problem, but I don't have 2FA authentication enabled. I'm using app passwords and even created a fresh one.

[dequis]

@marcelvb Try not using app passwords?

[marcelvb]

I thought I already tried, but I tried again just now, and it works.

[dequis]

Thank you! That's good to know, so we simultaneously have broken old style 2fa auth flow and broken app passwords regardless of 2fa. Fun.

The latter sounds like a server bug to me (not the first time it happens), former is likely our fault for being out of date, and i'll have to get around to implement that at some point (I hope it applies to my account these days, these staggered rollouts are annoying)

[alexolog]

Same thing starting from tonight

[isakrubin]

Setting a new app password worked for me ( while still using 2FA )

[marcelvb]

I created a new app password (again), and this time the new app password works.

[tuxmaster5000]

With the app password function it will work for me to.

[gbil]

Not so easy to generate app password when you have disabled your FB account and only kept messenger active (yes it is possible to do so)
Any workarounds in this case?

[zyphlar]

gbil: what happens when you visit https://www.messenger.com or https://www.facebook.com/settings ?

just reactivated 2fa and used an app password, works fine for me now too. thanks everyone.

[gbil]

gbil: what happens when you visit https://www.messenger.com or https://www.facebook.com/settings ?

just reactivated 2fa and used an app password, works fine for me now too. thanks everyone.

short version: I had to re-enable my account to enable 2fa with a 3rd party app (eg. freeotp) and generate an app password in between to make it work

long version: with fb disabled it was still sending me app password via SMS which I couldn't use anymore in pidgin as discussed here. When I tried to login to FB to generate an app password or to login to the messenger webpage, it was requesting me additional authentication which I couldn't get because 1. generator via FB app with FB disabled wouldn't work 2. if I selected to get a code via SMS it wouldn't sent it !!!!
So I had to re-enable my FB account just to enable 2fa with a 3rd party app (for future use if possible) and generate an app password for pidgin

I guess FB doesn't really care much for people like me who disabled their FB account and only kept messenger

[p0358]

I can confirm app password without 2FA stopped working, and it did work before. Turning back to regular password did make it work again for me