# 2FA - do we have to do anything to enable it?
**URL:** https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609
**Category:** Support
**Tags:** 2fa
**Created:** [August 13, 2018, 3:55pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609 "2018-08-13T15:55:27Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [August 13, 2018, 3:55pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/1 "2018-08-13T15:55:27Z")
Received an email from someone having trouble enabling 2FA - yet I don’t recall ever turning this on or setting up anything for it, do I have to?
> [@](#):
>
> Hi,
>
> Sorry for the disturbance.
>
> I’ve created an account today and tried to enable two-factor authentication however the operation constantly fails with the following message “Invalid authentication code. Each code can only be used once.”.
>
> Steps:
>
> 1. Go to preferences.
> 2. Click “Edit” in the 2FA section.
> 3. Scan a barcode with Google Authenticator app.
> 4. Enter the code from the GA app.
> 5. See the error “Invalid authentication code. Each code can only be used once.”.
>
> My main browser is Firefox Dev Edition (62.0b16 (64-bit)) however I’ve tried to perform this action in Safari (Version 11.1.2 (13605.3.8)).
>
> Several attempts have been performed in each browser.
>
> Could you please take a look and assist?
>
> Thanks.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [August 13, 2018, 4:01pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/2 "2018-08-13T16:01:24Z")
2FA was added back in early March. See [Discourse 2.0.0.beta4 Release Notes](https://meta.discourse.org/t/discourse-2-0-0-beta4-release-notes/82446). You (a Discourse site admin) shouldn’t need to do anything.
@featheredtoast may have some suggestions on what to try (or to ask the user to try) to get this working.
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [August 13, 2018, 4:04pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/3 "2018-08-13T16:04:51Z")
Thanks 🙂
Is there anyway we can disable it? I haven’t looked into it so not sure how it works, but I don’t like the idea of having to rely on (or send user info to) a third party.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [August 13, 2018, 4:09pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/4 "2018-08-13T16:09:19Z")
I don’t believe it can be disabled, no. Also, no data is being sent to a third party.
Here’s a quick summary of 2FA: Discourse implemented the TOTP (time-based one time password) algorithm. When a user decides to enable 2FA they are presented with a QR code (or a long string of characters). That string is used by an authentication app (like Google Authenticator, Microsoft Authenticator, Authy, YubiKey, etc.) to generate a new 6-digit password every 30 seconds. Those apps are in no way connected to your Discourse site, nor do they have any user info. They simply generate a code every 30 seconds. Your Discourse site also knows what those codes are, so when a user tries to log in, after entering their username and password they’re asked for a code. They check their app, enter the code, and the server checks if it’s the same code it expected.
Does that make sense?
---
### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [August 13, 2018, 4:14pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/5 "2018-08-13T16:14:01Z")
A good thing to check is whether or not the server time is in sync with the world (generally through ntp).
Having an incorrect time can cause some interesting errors as this protocol is time based.
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [August 13, 2018, 4:21pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/6 "2018-08-13T16:21:24Z")
Thanks both 🙂
> [@jomaxro](#):
>
> Your Discourse site also knows what those codes are, so when a user tries to log in, after entering their username and password they’re asked for a code. They check their app, enter the code, and the server checks if it’s the same code it expected.
Does it need to connect to a third party to learn/check what those codes are? Or is it all generated on my server?
> [@featheredtoast](#):
>
> A good thing to check is whether or not the server time is in sync with the world (generally through ntp).
>
> Having an incorrect time can cause some interesting errors as this protocol is time based.
Just checked the time and it’s fine.. would timezones matter? I’m guessing the person is in a different timezone to that of what is set for the server.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [August 13, 2018, 4:30pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/7 "2018-08-13T16:30:27Z")
Ask the user to use the “Time correction for codes” operation in the app’s settings.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [August 13, 2018, 4:53pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/8 "2018-08-13T16:53:12Z")
> [@AstonJ](#):
>
> Does it need to connect to a third party to learn/check what those codes are? Or is it all generated on my server?
Not at all - it is 100% on the server.
> [@AstonJ](#):
>
> Just checked the time and it’s fine… would timezones matter?
No. It’s based off UTC; not local time.
What may help is if you want to check what the server’s opinion of the current code is you can use e.g. from the rails console:
```plaintext
pry(main)> User.find_by(username: "Supermathie").totp.now
=> "319971"
```
---
### Author:  [@sampoullain](https://meta.discourse.org/u/sampoullain)
#### Post date: [February 19, 2020, 10:40am UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/9 "2020-02-19T10:40:56Z")
Hey, is it possible for an admin to turn off someone’s Two Factor Authentication?
It doesn’t seem there is an option to do this, but one of our community is locked out and cannot get in as he has his 2FA setup.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [February 19, 2020, 12:25pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/10 "2020-02-19T12:25:43Z")
It is not possible to disable 2FA from the user interface - doing so requires rails console access. See [How to disable 2FA - #11 by featheredtoast](https://meta.discourse.org/t/how-to-disable-2fa/131475/11)
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [January 20, 2024, 3:05pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/11 "2024-01-20T15:05:45Z")
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 20, 2024, 3:13pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/12 "2024-01-20T15:13:39Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [January 20, 2024, 4:02pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/13 "2024-01-20T16:02:40Z")
A little update on this one - admins can now disable 2FA for other users from each user’s `/admin/users` page. 👍