Improvement for 2FA

Open stewrg opened this issue 8 years ago • 1 comments

When enabling 2FA is is not clear to the user that the new device must be Enabled.

I have had several users click past the enablement stage, which means they then block themselves by repeatedly entering a password AND the generated 2FA code - unaware that they have not enabled the device.

Is it possible to force the user to enter the enablement code before returning to other parts of the platform?

Jun 14 '17 08:06 stewrg

Yes, add banner indicating that the token has to be activated below the QR, also add the form for said token activation. Good call!

Oct 07 '17 15:10 bapril