I go to Settings, check the “Set up 2-factor authentication” box, click Save, reload the page, but clicking on “2FA installation link” does nothing. I tried copying the “secret” value from the link and using it to manually add an account in my 2FA app (Authy) but that doesn’t seem to work. The account gets added, but the codes it generates don’t seem to work for logging in (using a different browser).
I really don’t want to lock myself out. Am I doing something wrong, or is this a known issue?
2FA is effectively a failed implementation in Lemmy
Hey there, we don’t want you to lock yourself out either. Unfortunately 2FA for lemmy is not up to par. I’d suggest staying away from it for the time being.
Before you do happen to lock yourself out, please make sure your account has an email address associated; then you can reach out to us on Discord or Matrix, we can reset it for you.
My experience: Beehaw/Lemmy is using a SHA256 hash for the secret key. A lot of 2FA apps only support SHA1. So you’ll need to find one that supports SHA256. I used Google Authenticator. I thought I also saw that Microsoft Authenticator works too. Storing in Bitwarden doesn’t work.
Good luck.
I would definitely do all my testing in private browsing or another browser while leaving a browser window logged in to disable 2FA should you need to.
Storing the secret key inside bitwarden produced incorrect codes. Due to Bitwarden only supporting SHA1 while Lemmy/Beehaw using SHA256.
I just checked the 2FA codes stored in my Bitwarden. Ends with algorithm=SHA256&issuer=Beehaw. Also logged out and logged in again before posting this comment.
Don’t think SHA-256 is the issue.
One usual cause of incorrect 2FA codes is incorrect system time. You can use https://time.is/ to see if that’s the case.
