Samuel
@samuel.fm
my app bluesky is so beautiful when the sun is low
2 1 21
𝚒𝚗𝚝𝚎𝚛𝚗𝚎𝚝 𝚏𝚛𝚘𝚐Hopefully I'm not bugging you, Samuel, BUT
I found a bit of an oversight in the email implementation of 2FA. When you first enable it, it should send an email to verify that the user still has access to that email & request a confirmation code. Otherwise, it can't be disabled.
1 1 3
P(aul) FrazeeAre you user it isn't? I put into place a flow that will run confirmation if that hasn't happened yet. If the email is already confirmed it doesn't do that.
1 4𝚒𝚗𝚝𝚎𝚛𝚗𝚎𝚝 𝚏𝚛𝚘𝚐But even if they have confirmed the email was verified, it doesn't take into account how long ago it was verified. A user could have lost access to that account since then.
1 1P(aul) FrazeeHmm. Okay I'll consider that
also user = sure* lol
1 1𝚒𝚗𝚝𝚎𝚛𝚗𝚎𝚝 𝚏𝚛𝚘𝚐For example, I must have verified my email 6 months ago. Once you toggle the 2FA switch there's no going back either. So woe to the person who signed up using 10minutemail.com (or forgot their password to their email or whatever)
1 1P(aul) FrazeeYep, makes a lot of sense
2