?
avatar SDKiller
SDKiller
13 Jun 2014

When user uses last one-time emergency password - it is done silently.

If he forgets to enter into editing his profile and save it to auto-generate new set of oteps - he will not be able to login with otep next time.

I suppose he should be notified of this (notification should be comprehensive enough) - and maybe redirected to his profile edit page.

avatar SDKiller SDKiller - open - 13 Jun 2014
avatar brianteeman
brianteeman - comment - 27 Aug 2014

@nikosdion Any thoughts on this request?

avatar nikosdion
nikosdion - comment - 27 Aug 2014

This is by definition unnecessary. OTEPs are supposed to be printed / written down. Also, as their name (One Time Emergency Passwords) implies each one can be used only once. Therefore, each one you use one of them you cross it out and can never use it again. If you have not realised that you have either crossed out all 10 OTEPs or that you have tried unsuccessfully log in with nine of them and now you are using the only one left, well, can we agree that your problem is much bigger than using up all OTEPs?

avatar SDKiller
SDKiller - comment - 27 Aug 2014

@nikosdion

The main point that process of regenerating OTEPs is not intuitive and user profile layout is not 'user-friendly' for this case - so user may realise that he uses the last OTEP but not sure what to do to create a new set.
Just try it and think - if it is obvious for end user (not developer).

avatar nikosdion
nikosdion - comment - 27 Aug 2014

It is indeed not obvious at all, that's why you are told about it upfront, when presented with the OTEPs. At this point you are asked to print the page for future reference.

If you are wondering, there is a reason why I don't want to implement an automatic redirection. It is possible that when you log in there is a redirect URL sent with your request. If we override it with a redirection to the profile edit page we are violating the way Joomla! works. If we do the redirection to the profile edit page conditionally (only when a redirection URL is not present) we are creating an inconsistent feature.

Furthermore the OTEPs are emergency codes, only to be used when you don't have your authentication device with you or if you have lost it. The reasoning is that you need to log in to the site to disable 2FA or log in in a hurry from an untrusted device. In the former case you are heading to the profile page anyway. In the latter case you should not be shown the OTEPs since you cannot trust the device you are displaying them in.

avatar zero-24 zero-24 - close - 27 Aug 2014
avatar SDKiller SDKiller - change - 27 Aug 2014
Status New Closed
Closed_Date 0000-00-00 00:00:00 2014-08-27 12:57:15
avatar SDKiller SDKiller - close - 27 Aug 2014
avatar zero-24 zero-24 - change - 7 Jul 2015
Labels Added: ?

Add a Comment

Login with GitHub to post a comment