Wordpress-android: Magic links "Send Link" doesn't work with 2fa

[nbradbury]

• Logout of the app
• Sign into wp.com using your email address
• Tap "Next"
• Tap "Send Link"
• Tap "Launch your email app"
• Open the sign in email and tap "Sign in to WordPress.com"

You'll be directed to the page below, which instructs that you'll receive a push notification in the WordPress app - which of course you never receive, since you're not signed in.

[maxme]

IIRC, magic links should be disabled for users with 2FA.

[maxme]

@nbradbury I think you get this screen only if you have another device signed in with the same username. I just tried with a unsigned 2fa user and it shows me the "verify by code" screen directly.

[kwonye]

IIRC, magic links should be disabled for users with 2FA.

No, it was tested to work with 2FA.

@nbradbury I think you get this screen only if you have another device signed in with the same username. I just tried with a unsigned 2fa user and it shows me the "verify by code" screen directly.

Thanks for testing, you're correct. From what I recall, only a small fraction of 1% of our users use 2FA in the first place. Of that group, I don't know how many of them are signed into multiple devices. Hopefully if they have 2FA enabled + multiple devices, they are knowledgable enough to understand how to enter their code. What do you guys think?

[nbradbury]

If this really does only occur when logged into multiple devices (in my case, a real device and an emulator), then I think we can ignore it.

[designsimply]

Just an update, no action needed. I agree it's not worth re-opening this case unless we hear of more complaints directly from users about this very specific problem.

I was beta testing WPAndroid alpha-183 (13.0 alpha) and found that even though the prompt for the 2FA verification code happens on a mobile web browser, you are redirected to the app but only after entering the 2FA verification code in the web. So, the 2FA account + magic link login flow does work, it's just that the verification code entry in the middle happens on the web and not in the app. (50s)

Note: I made sure to test with an account which was not currently signed in to any other device.