Mastodon: 2FA not functioning as expected

[bignimbus]

This may be a symptom of the unusually large server load happening today, but so far I am locked out of my account and I'm not sure what to do about it.

Steps to reproduce:

1. Go to account settings
2. Select the option to set up 2FA
3. Trigger a server error somehow
4. Log out
5. Enter username & pass to log in
6. App asks for 2FA credentials, user doesn't have them
   
   
   
   • (Asking to resend confirmation also doesn't work)
   
   

Not sure how to recover my personal account, but it seems that there's also an issue with the app gracefully handling 2FA config. Thank you! I ❤️ 🐘

[tobypinder]

It would be fair to say everything is very much down right now, there's significant inability to do anything at this point. There may or may not be an issue but it's probably worth checking again once the infrastructure is stable :)

[0xa]

I noticed the same, it would be great to ask for a code before saving the new settings, it's a nice way to check if it was scanned and saved correctly.

[yoannf]

Also it should provide with a few rescue codes, so that nobody's ever locked out of its own account.

[bignimbus]

Additionally, if anyone at mastodon.social could help me rescue my own account, that'd be great! I'm locked out :(

[ghost]

Same than @bignimbus . Need something to recovery our account :c

[mattdkerr]

2FA via Authenticator app would also be more reliable than email; I keep getting mastodon.social emails in my spam folder

[mattdkerr]

Nice- thanks for adding QR/OTP for authenticators!

[bignimbus]

@Gargron this is great, thanks! This will definitely help those who enable 2FA from now on.

I'm wondering how users like myself and @LeFryskai might recover our accounts. I am still unable to log into mastodon.social for the reasons above. I appreciate your consideration!

[Gargron]

@bignimbus you should have sent an email to me! I'll disable your 2fa asap

[mattdkerr]

I am thinking you need an automated way to recover from 2FA loss (phone lost, etc), like an account recovery code created at time of turning on 2FA. This is how it works elsewhere.
Where do I email for recovery?

[angristan]

@bignimbus you should have sent an email to me! I'll disable your 2fa asap

How can we (admins) do that ?

[bignimbus]

@Gargron that's very kind! Unfortunately I don't have your contact information handy. Like @mattdkerr, I'm not sure what address to email for account recovery. Hope to hear back from you -
cheers, and thanks for a great app.