Wrong Error message for U2F Error code 4.

[My1]

Steps to reproduce

0. have 2 different U2F devices ready
1. set one of them as 2FA for the account.
2. try to log in
3. use THE OTHER U2F Device.

Expected behaviour

Error Message 4 saying that the stick used is unknown to this account

Actual behaviour

Error message 4 saying "Failed security key activation (4)."

Reason

Error Message 4 works differently for Registration and Login as described here:
https://developers.yubico.com/U2F/Libraries/Client_error_codes.html

For Registration: the key is already used.
For Login: the key is unknown.

Server configuration

Operating system: Win 8.1 Pro x64

Web server: Caddy 0.10.11

Database: MySQL 5.6.21

PHP version: 7.2.0

phpMyAdmin version: 4.8 RC1

Client configuration

Browser: Opera 52

Operating system: Win 8.1 Pro x64

[williamdes]

can U2F keys be emulated ?

[My1]

in theory yes. I dont know how though although there are a few of them which are VERY cheap.

[williamdes]

I added this to 5.2, it is a quick fix from what I see and the message is not "wrong" but from the code I can see we could implement more specific error codes than just error code 5

phpmyadmin/js/src/u2f.js

Lines 14 to 20 in 287d743

	if (data.errorCode === 5) {
	Functions.ajaxShowMessage(Messages.strU2FTimeout, false);
	} else {
	Functions.ajaxShowMessage(
	Functions.sprintf(Messages.strU2FError, data.errorCode), false
	);
	}

[quinnzipse]

Hi! I'm looking to make my first contribution to an open source project! Is there some way I can help with this issue?

[williamdes]

Hi! I'm looking to make my first contribution to an open source project! Is there some way I can help with this issue?

Hi @quinnzipse
You can work on this issue on QA_5_1 branch. You will need to add a case to the script above and add a Messages. string

Let me know if you need help