After enabling and testing TOTP authentication as my second factor, I would like to save my recovery/backup codes, however under Two-Factor Backup Codes on the Preferences > Security > Manage Two-Factor Authentication page it says,
You must enable a primary two-factor method before generating backup codes.
What does enabling a primary two-factor method entail in the case of a configured TOTP second factor?
It appears that there is an unspecified requirement to log out of the current session, then log back in, after which the confusing message is replaced by “ Add backup codes”.
This seems odd since I want to save codes, not add them. Clicking it, results in a modal
Two-Factor Backup Codes
You haven’t created any backup codes yet.
Create backup codes
Clicking Create backup codes generates the codes and offers opportunity to download or copy them - something I expected to be able to do immediately after enabling my second factor authentication, not after this confused and confusing obstacle course.
I strongly recommend offering the generated recovery/backup codes upon activation of the second factor authentication with suitable advice on securely saving them and their use - consistent with the vast majority of similar interfaces.
An option to generate replacement codes should also be offered.