Given the recent attack, I think this is a good opportunity to remind of the importance of using 2FA.
(although it doesn’t appear to make any difference in this case as session cookies were being exploited so login credentials were not needed)
But for me at least, this event has made me go back and take another shot at setting up 2FA.
I am happy to report I finally got it working on all my Lemmy accounts/instances, so I thought I’d share some tips:
- I still haven’t figured out how to set up via desktop, use a mobile browser.
- Follow these steps:
- Check the enable 2fa box on your account settings and click Save
- A message will show about a button appearing when the page refreshes
- The button usually doesn’t appear for me at first.
- You can simply manually refresh the page at this point to make the button appear
- The button should now be visible. Click the button.
- This opens a
otpauth://link which on a mobile device should be handled by a 2FA app if you have one installed.
- Authy does not work: It will generate a code happily but that code will not work when you try to login to your Lemmy account.
- Google Authenticator worked for me. It appears the type of TOTP code Lemmy is using is not compatible with some authenticator apps.
- I think if you can find a desktop app that registers as a provider for the
otpauth://links it may be possible to do on desktop as well. - You can also pull the
secret=value from the link to manually add it to an authenticator on/from desktop.
After several failed attempts previously, I finally figured out Authy was the problem and I have now secured all my Lemmy accounts with 2FA. Annoying that I have to use GA, but that appears to be an Authy issue not a Lemmy one.
2FA might not have made any difference today but it very well might in the future.
Stay safe everyone! 🔐
You must log in or # to comment.
It may not be wise to enable 2FA until Lemmy fixes the implementation. It’s currently very easy to get permanently locked out of your account, through no fault of your own. Especially if you don’t have an email address linked to your account.
This happened to me. I was going to try it and when I saw that the option wasn’t what I expected, I intended to close it, but I guess either I didn’t or it’s buggy because it’s enabled now and there’s no encryption key, so no way to login. Then the server logged everyoner out cause of the hack. This was on lemmy.world, btw, I have an account on kbin too.
I sent an email, but no word yet obviously. I’m sure they’re busy.
Jeez, that sucks. Hope you get back in soon!
If you are concerned, I would suggest keeping another browser/device/etc logged in when trying to enable 2FA.
Then if the 2FA activation fails, you can use that second session (which does not get logged out when you enable 2FA) to then disable it again.For sure! But I don’t think non-advanced users should be enabling 2FA right now. It’s puzzling that Lemmy pushed the feature in its current state to production.
Got to say the fact there are no backup codes and you can reset your password and disable 2FA without confirming it’s you by using your 2FA makes this protection pretty poor
Yeah it needs some love, but I still think it’s better to have than not.
It’s not less secure than a password alone.
If you paste the entire URL it gives you, bitwarden also works.
I look forward to the day when FIDO2 (YubiKey) and passkeys are supported.
2FA feels very half-baked atm.
Tried to set it up and got locked out, but apparently you can get around 2FA by simply requesting a password reset…
That seems like a massive security flaw, and essentially makes 2FA non-existent atm.
Microsoft authenticator doesnt work!
Additionally it needs QR-Code Support, Backup-Codes and disabling only after double-check of your current password.
I think the missing QR-Code is a main flaw that holds non tech savvy people back from using it at all.
The TOTP feature in Bitwarden works, if you paste in the whole
otpauth://URI to Bitwarden’s Authenticator Key (TOTP) field. The URL specifies that the hashing algorithm should be SHA256. If you just import thesecret=value into Authy, it probably defaults to using the SHA-1 algorithm, which may be why the codes generated by Authy don’t work.SHA256 is more secure than SHA-1, which I guess is why Lemmy has chosen to use it for its 2FA feature.
I cant wait for email based 2 factor authentication to be implemented. Or then Authy can finally work.
Is there a way to get backup codes? I enabled 2FA, but I don’t see anywhere to generate them.
I couldn’t find backup codes but I was able to perform a password reset which logged me in and let me disable or reconfigure 2fa.
Seems strange that you could remove 2FA without being forced to authenticate via 2FA first.
