I've deleted all my Reddit accounts, but from time to time I remember seeing something on some subreddit way back when that would be useful for something I'm currently working on and try to search for it.This time I found a rabbit hole in the process and couldn't help but share what I found.
That sounds like a gaping security hole, but with how likely it is that you lock yourself out with the current 2FA implementation, I can't be mad about it.
If all else fails you could also reach out to the admin of your instance I suppose and see if they can disable 2FA on your account, but I figured it's best to avoid the headache altogether and just not log out until you're 100% the 2FA works properly.
That's also a good way of verifying! As long as you go through the login process somewhere different than your current browser window you should be able to make sure it works properly.
Current 2FA implementation in Lemmy is a bit janky with the risk of being locked out.
First things first: DO NOT UNDER ANY CIRCUMSTANCES LOG OUT UNTIL YOU’RE 100% SURE YOUR AUTHENTICATOR WORKS AND THAT YOU CAN LOGIN USING ITS GENERATED 2FA CODE
Now that that’s out of the way, here are some steps to follow:
Ideally clicking on that button will open your authenticator which will then prompt you to select login credentials to attach it to; if it doesn’t and you instead are lead to a URL with a secret key or if you right click and you can copy that URL, then you need to manually copy the URL and paste it in the 2FA section of your authenticator or password manager
Once you’ve figured this out don’t log out, instead open a private browser window and test to see if you can login with your credentials + 2FA
If you can’t get it to work then you can disable it in the window you’re still logged into.
If you share which authenticator you use, people might be able to give you more specific instructions to get you through step 1.
Whatever you do, don’t log out. You will be locked out!Unlike most common implementations, there is no built in step to verify if you can successfully generate a TOTP before 2FA is fully enabled.
Pro tip: if you do insist on using Google scroll to the bottom until you see a notice like the one below.
You can then click on the complaint to see the URLs that were removed.
They’ve wisened up a bit and now require a (throwaway) email to access the links, but chances are that if you’re looking for something more obscure, the link you seek is still there.
Definitely!
I've deleted all my Reddit accounts, but from time to time I remember seeing something on some subreddit way back when that would be useful for something I'm currently working on and try to search for it.This time I found a rabbit hole in the process and couldn't help but share what I found.