What happens if you implemented two-factor authentication with your phone and you lost it?
How to recover and use another program, e.g., pass-otp, instead?
Since one cannot login without the second factor, how to get the tokens (secret, issuer) that will allow to setup another program?
You’ll have to disable 2FA through rails console. Discourse doesn’t have a built in SMS/Email based recovery mechanism as of now.
Discourse have backup tokens, which are to be used if you lose your OTP device.
You can also register the OTP in multiple devices.
FIDO2 keys can also be used, and Discourse support using multiples, so you can have backup keys stored in safe places, your main one, and the ones who are backed into your device, like Android fingerprint and Windows Laptop Hello devices.
If you did neither, you will have to contact the admin team and ask then to disable 2FA on your account.
OK, can you please point to the procedure to disable 2FA from the console?
Search “disable 2fa” first result says
So:
./launcher enter app
rails c
id = User.find_by(username: "YOURUSERNAME").id
UserSecondFactor.totps.where(user_id: id).each(&:destroy!)
음, 실제로는 위 방법을 따랐더니 이메일로 로그인하는 것도 불가능해졌고, 다음과 같은 메시지가 표시됩니다:
선택한 2단계 인증 방법이 계정에 활성화되어 있지 않습니다.
다른 관리자에게 확인해 보니 해당 계정에 2FA가 활성화되어 있지 않았습니다.
수정 제안된 해결책이 작동하지 않아서 이 주제를 #contribute:bug로 변경했습니다.
Today I looked at it again and found that:
[25] pry(main)> how.totp_enabled?
=> false
[26] pry(main)> how.backup_codes_enabled?
=> true
[27] pry(main)> how.totp_or_backup_codes_enabled?
=> true
So I tried to remove the backup codes as well, following the response above from @falco:
UserSecondFactor.backup_codes.where(user_id: id).each(&:destroy!)
Now here is the complete solution to disable OTP for a user when they lost their ways back in: you must remove both the totps entries and the backup_codes as well, so that the call to #totp_or_backup_codes_enabled? returns false.