[Important Bug] Fakku's 2-Factor Authenticator System
1
FoolyDooly
Bought With Mastercard
I have used this since it has been updated to be able to use them, and I realize this system has too much flaws for me to continue using it safely. Here are some flaws and bugs I will note, in hopes that one day they are fixed.
1. Login system does not indicate correctly whether the password was wrong or authenticator code was wrong sometimes correctly. This can be ignored in a sense that we can say "it's a feature not a bug" even if a user is not a malicious user, but then there's issue #2,
2. Authenticator system lags. Badly. I have removed/disabled it and re-enable it, tried time correcting it via Authenticator's app, nothing. The code you have is set to valid in system after which the time has expired on me. This could also be ignored for the factor that you could slap on "it's also a feature not a bug" but then...
3. There's no backup 2-Factor system, unlike many other places that has them. No e-mail code backup, no phone code backup, nothing. If authenticator code FAILS (like I have many times) or if user loses access to their authenticator, you're possibly locked out of your own account. This is not inherently fail-safe, but it's more of fail-fail. Sure we can provide some users with support by providing some way of proving their ownership (by verifying their Subscription purchase and etc) but what if user previously never made purchases on Fakku? Or what if the User lost all their information on themselves and can not provide last 4 digit of the credit card they used to make purchases? Or what if-
This system just had bit too many holes for me to enjoy. I loved the idea of being safe, but if I get locked out of my own account, consistently bashing in authenticator code 20 times to try to log in, this isn't safe system. I would have to say this is huge criticism point for me, and I hope Fakku eventually improves this part of the site.
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." Unfortunately, this sentence has proven to be true once again, but ironically in the wrong place at the wrong time.
1. Login system does not indicate correctly whether the password was wrong or authenticator code was wrong sometimes correctly. This can be ignored in a sense that we can say "it's a feature not a bug" even if a user is not a malicious user, but then there's issue #2,
2. Authenticator system lags. Badly. I have removed/disabled it and re-enable it, tried time correcting it via Authenticator's app, nothing. The code you have is set to valid in system after which the time has expired on me. This could also be ignored for the factor that you could slap on "it's also a feature not a bug" but then...
3. There's no backup 2-Factor system, unlike many other places that has them. No e-mail code backup, no phone code backup, nothing. If authenticator code FAILS (like I have many times) or if user loses access to their authenticator, you're possibly locked out of your own account. This is not inherently fail-safe, but it's more of fail-fail. Sure we can provide some users with support by providing some way of proving their ownership (by verifying their Subscription purchase and etc) but what if user previously never made purchases on Fakku? Or what if the User lost all their information on themselves and can not provide last 4 digit of the credit card they used to make purchases? Or what if-
This system just had bit too many holes for me to enjoy. I loved the idea of being safe, but if I get locked out of my own account, consistently bashing in authenticator code 20 times to try to log in, this isn't safe system. I would have to say this is huge criticism point for me, and I hope Fakku eventually improves this part of the site.
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." Unfortunately, this sentence has proven to be true once again, but ironically in the wrong place at the wrong time.
1
Thank you for your reported issues with the two-step authentication system. The issues of 1 and 3 will be addressed once I finish my re-write of the codebase for it. I'll be implementing backup codes, 30 days remembers, and better error handling.
As for #2, this issue is now resolved, our NTP pool was not syncing our time correctly which resulted in invalid codes. This has since been fixed and shouldn't be an issue anymore.
As for #2, this issue is now resolved, our NTP pool was not syncing our time correctly which resulted in invalid codes. This has since been fixed and shouldn't be an issue anymore.